CVE-2026-55770 OpenBao: LDAPi ldaputil (wrong escape func)
Attackers can bypass LDAP authentication filters to impersonate other users and access their secrets if specific AD binding configurations are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55770?
CVE-2026-55770 is a medium-severity vulnerability in openbao, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5.
Weakness: CWE-90
Which versions are affected by CVE-2026-55770?
6 open source packages ship an affected version, including github.com/openbao/openbao and openbao.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openbao/openbao Go | All versions | 0.0.0-20260617104213-10b7825c714c |
github.com/openbao/openbao Go | All versions | 0.0.0-20260617104213-10b7825c714c |
github.com/openbao/openbao Go | All versions | 0.0.0-20260617104213-10b7825c714c |
github.com/openbao/openbao Go | From 0.1.0 to 2.5.4 | None |
github.com/openbao/openbao Go | From 0.1.0 to 2.5.4 | None |
openbao Bitnami | All versions | 2.5.5 |
How do I fix CVE-2026-55770?
Upgrade github.com/openbao/openbao to 0.0.0-20260617104213-10b7825c714c or later.
Is CVE-2026-55770 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55770 exists.
Sources
Also known as BIT-openbao-2026-55770, GHSA-6mwx-4547-5vc9, GO-2026-5182.