CVE-2026-55776 OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
An authenticated user with write access can crash the OpenBao server by creating an invalid asymmetric derived key, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55776?
CVE-2026-55776 is a medium-severity denial of service vulnerability in openbao, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy creation path in builtin/logical/transit/backend.go and sdk/helper/keysutil/policy.go could reach an error path that double-unlocked a mutex while handling this invalid asymmetric derived-key combination, causing a panic, no HTTP response, process exit, and denial of service. JSON and HCL key-creation requests can express the triggering combination. This issue is fixed in version 2.5.5.
Weakness: CWE-617
Which versions are affected by CVE-2026-55776?
6 open source packages ship an affected version, including github.com/openbao/openbao and openbao.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openbao/openbao Go | All versions | 0.0.0-20260617104123-db57c62602b2 |
github.com/openbao/openbao Go | All versions | 0.0.0-20260617104123-db57c62602b2 |
github.com/openbao/openbao Go | All versions | 0.0.0-20260617104123-db57c62602b2 |
github.com/openbao/openbao Go | From 0.1.0 to 2.5.4 | None |
github.com/openbao/openbao Go | From 0.1.0 to 2.5.4 | None |
openbao Bitnami | All versions | 2.5.5 |
How do I fix CVE-2026-55776?
Upgrade github.com/openbao/openbao to 0.0.0-20260617104123-db57c62602b2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-55776 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55776 exists.
Sources
Also known as BIT-openbao-2026-55776, GHSA-8w8f-r2xv-4q4j, GO-2026-5267.