CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
Attackers with specific namespace capabilities can bypass ACL checks to modify or delete the containing namespace's configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55775?
CVE-2026-55775 is a low-severity missing authorization vulnerability in openbao, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/* endpoint family can resolve its containing namespace through a path prefix or X-Vault-Namespace header. ACL checks occurred before root canonicalized to an empty path, causing /sys/namespaces/root to resolve to the system backend's containing namespace and allowing permitted lookups, deletion, locking, or custom metadata changes against that direct containing namespace. The root namespace and arbitrary unrelated namespaces are not affected, and available operations depend on the capabilities granted on the path and subpaths such as /api-lock. This issue is fixed in version 2.5.5.
Weakness: CWE-285
Which versions are affected by CVE-2026-55775?
6 open source packages ship an affected version, including github.com/openbao/openbao and openbao.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openbao/openbao Go | All versions | 0.0.0-20260617103935-d3c1cc64b1ae |
github.com/openbao/openbao Go | All versions | 0.0.0-20260617103935-d3c1cc64b1ae |
github.com/openbao/openbao Go | All versions | 0.0.0-20260617103935-d3c1cc64b1ae |
github.com/openbao/openbao Go | From 0.1.0 to 2.5.4 | None |
github.com/openbao/openbao Go | From 0.1.0 to 2.5.4 | None |
openbao Bitnami | All versions | 2.5.5 |
How do I fix CVE-2026-55775?
Upgrade github.com/openbao/openbao to 0.0.0-20260617103935-d3c1cc64b1ae or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-55775 being exploited?
There is no known exploitation of CVE-2026-55775 in the wild and no public exploit code.
Sources
Also known as BIT-openbao-2026-55775, GHSA-mwr2-wmgp-crj6, GO-2026-5517.