{"id":"CVE-2026-55774","title":"OpenBao is an open source identity-based secrets management system","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known…","severity":"low","cvss":2.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-863"],"vendor":"openbao","product":"openbao","affected":["openbao < 2.5.5"],"patched":["github.com/openbao/openbao 0.0.0-20260617103932-b20b999dd404"],"published":"2026-09-15","updated":"2026-09-15","sourceUpdated":"2026-09-15T18:17:24.323","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55774","references":[{"url":"https://github.com/openbao/openbao/commit/9ba1413d793223cca67db12434093a2f25fdc540","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/pull/3307","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/pull/3310","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/releases/tag/v2.5.5","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/releases/tag/v2.6.0","label":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-c36x-h252-g9x2"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55774.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-55774"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55774"}],"tags":["nvd","cve.org","ghsa","go","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-15T17:26:36.523521Z"},"cvssSource":"cna","ecosystem":"go","ingestedAt":"2026-06-22T13:35:24.287Z","scores":{"cna":2.1,"vendor":2.7},"epss":0.00444,"epssPercentile":0.3805,"slug":"CVE-2026-55774","body":"## Overview\n\nOpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known, bypassing namespace ACL isolation. The affected lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the request namespace, allowing a tenant that intentionally disclosed a lease identifier to have the lease and its underlying credential revoked by another tenant. This issue is fixed in version 2.5.5.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55774)\n\nAffected packages:\n\n- `github.com/openbao/openbao >= 0.1.0, <= 2.5.4`\n- `github.com/openbao/openbao < 0.0.0-20260617103932-b20b999dd404`\n\nPatched in:\n\n- `github.com/openbao/openbao 0.0.0-20260617103932-b20b999dd404`\n\nSource: https://github.com/advisories/GHSA-c36x-h252-g9x2\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55774.json)","depth":"sunlit","depthScore":12,"depthScoreParts":{"impact":11.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":204267,"id":"CVE-2026-55774","ts":1789490437721,"field":"cvss","old":null,"new":"2.1"}]}