CVE-2026-55776
Received Received - Intake

Denial of Service in OpenBao via Invalid Asymmetric Key Derivation

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy creation path in builtin/logical/transit/backend.go and sdk/helper/keysutil/policy.go could reach an error path that double-unlocked a mutex while handling this invalid asymmetric derived-key combination, causing a panic, no HTTP response, process exit, and denial of service. JSON and HCL key-creation requests can express the triggering combination. This issue is fixed in version 2.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55776
EUVD
EUVD-2026-78682

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openbao openbao to 2.5.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenBao allows an authenticated user with write access to the transit engine to crash the server by creating a key with an asymmetric type (rsa-, ecdsa-, or ed25519) while setting the derived parameter to true. This causes a panic due to a double-unlock of a mutex, leading to process termination and denial of service.

Detection Guidance

To detect this vulnerability, monitor OpenBao server logs for crashes or panics during key creation in the transit engine. Check for failed HTTP responses when users attempt to create asymmetric keys with derived set to true. Ensure your OpenBao version is below 2.5.5.

Impact Analysis

An attacker could exploit this to crash OpenBao servers, disrupting secrets management operations. This results in downtime, loss of access to critical secrets, and potential cascading failures in systems relying on OpenBao for authentication or encryption.

Compliance Impact

This vulnerability could lead to service disruptions, violating availability requirements in GDPR and HIPAA. Downtime may result in unauthorized access to sensitive data or failure to meet data protection obligations, potentially leading to compliance violations and penalties.

Mitigation Strategies

Upgrade OpenBao to version 2.5.5 or later immediately. If upgrading is not possible, restrict write access to transit/keys/* paths for untrusted users. Validate key creation requests to reject asymmetric key types with derived set to true.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart