CVE-2026-55775
Received Received - Intake

Namespace Privilege Escalation in OpenBao

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/* endpoint family can resolve its containing namespace through a path prefix or X-Vault-Namespace header. ACL checks occurred before root canonicalized to an empty path, causing /sys/namespaces/root to resolve to the system backend's containing namespace and allowing permitted lookups, deletion, locking, or custom metadata changes against that direct containing namespace. The root namespace and arbitrary unrelated namespaces are not affected, and available operations depend on the capabilities granted on the path and subpaths such as /api-lock. This issue is fixed in version 2.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55775
EUVD
EUVD-2026-78680

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openbao openbao 2.5.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenBao before version 2.5.5 has a vulnerability where users with capabilities on /sys/namespaces/root in a non-root namespace could exploit namespace canonicalization. The system incorrectly resolved /sys/namespaces/root to the system backend's containing namespace before proper ACL checks, allowing unauthorized operations like lookups, deletion, or metadata changes on that namespace.

Detection Guidance

To detect this vulnerability, check the OpenBao version running on your system. If it is below 2.5.5, the system is vulnerable. Use the command 'openbao version' or check the version via the API endpoint /sys/health to confirm.

Impact Analysis

If exploited, this vulnerability could allow attackers with specific capabilities to perform unauthorized actions on namespaces they should not access. This includes modifying or deleting sensitive data, locking namespaces, or changing metadata, potentially leading to data breaches or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected OpenBao versions may face compliance violations, legal penalties, and reputational damage due to potential data exposure or tampering.

Mitigation Strategies

Upgrade OpenBao to version 2.5.5 or later immediately. Review and restrict capabilities granted on /sys/namespaces/root paths to prevent unauthorized access. Audit namespace configurations and ACLs for any misconfigurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55775. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart