---
id: CVE-2026-55770
title: OpenBao is an open source identity-based secrets management system
summary: >-
  OpenBao is an open source identity-based secrets management system. Prior to
  2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping
  function, where RFC 4515 LDAP search-filter escaping was required in
  sdk/helper/lda…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-90
vendor: openbao
product: openbao
affected:
  - openbao < 2.5.5
patched:
  - github.com/openbao/openbao 0.0.0-20260617104213-10b7825c714c
published: '2026-09-15'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T12:18:24.777'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55770'
references:
  - url: >-
      https://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659
    label: security-advisories@github.com
  - url: >-
      https://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3306'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3313'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.5.5'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.6.0'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-6mwx-4547-5vc9'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55770.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-55770'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-55770'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - go
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-16T03:56:33.833796Z'
epss: 0.00447
epssPercentile: 0.383
ecosystem: go
scores:
  nvd: 6.8
  vendor: 7.4
  cna: 6.8
ingestedAt: '2026-06-22T13:35:24.289Z'
---

## Overview

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55770)

Affected packages:

- `github.com/openbao/openbao >= 0.1.0, <= 2.5.4`
- `github.com/openbao/openbao < 0.0.0-20260617104213-10b7825c714c`

Patched in:

- `github.com/openbao/openbao 0.0.0-20260617104213-10b7825c714c`

Source: https://github.com/advisories/GHSA-6mwx-4547-5vc9

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55770.json)