CVE-2026-55774lowCWE-863

CVE-2026-55774: falha de baixa gravidade em openbao

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

Publicada em

Seguir esta CVE+ Monitorar openbao+ Monitorar github.com/openbao/openbao

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.1epss 0.6%
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known, bypassing namespace ACL isolation. The affected lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the request namespace, allowing a tenant that intentionally disclosed a lease identifier to have the lease and its underlying credential revoked by another tenant. This issue is fixed in version 2.5.5.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
openbao · openbao
CVEs relacionadas — openbao

No mesmo produto, das mais perigosas para as menos.

CVE-2025-59043HIGHOpenBao vulnerable to denial of service via malicious JSON request processingEPSS 0.7%CVE-2026-63132CRITICALOpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackEPSS 0.6%CVE-2026-46405MEDIUMOpenBao's Kerberos Auth Method Accumulates Unaccessible TokensEPSS 0.6%CVE-2026-55776MEDIUMOpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesEPSS 0.6%CVE-2026-55770MEDIUMOpenBao: LDAPi ldaputil (wrong escape func)EPSS 0.5%CVE-2026-63131MEDIUMOpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)EPSS 0.5%