---
id: CVE-2026-55774
title: OpenBao is an open source identity-based secrets management system
summary: >-
  OpenBao is an open source identity-based secrets management system. Prior to
  2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one
  namespace could revoke a lease in another namespace when the foreign lease_id
  was known…
severity: low
cvss: 2.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-863
vendor: openbao
product: openbao
affected:
  - openbao < 2.5.5
patched:
  - github.com/openbao/openbao 0.0.0-20260617103932-b20b999dd404
published: '2026-09-15'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T14:23:59.847'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55774'
references:
  - url: >-
      https://github.com/openbao/openbao/commit/9ba1413d793223cca67db12434093a2f25fdc540
    label: security-advisories@github.com
  - url: >-
      https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3307'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3310'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.5.5'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.6.0'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-c36x-h252-g9x2'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55774.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-55774'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-55774'
  - url: 'https://github.com/openbao/openbao'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - csaf
  - vex
  - red-hat
  - osv
epss: 0.00562
epssPercentile: 0.44388
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T17:26:36.523521Z'
cvssSource: cna
scores:
  cna: 2.1
  vendor: 2.7
ingestedAt: '2026-06-22T13:35:24.287Z'
aliases:
  - GHSA-c36x-h252-g9x2
  - BIT-openbao-2026-55774
  - GO-2026-5304
---

## Overview

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known, bypassing namespace ACL isolation. The affected lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the request namespace, allowing a tenant that intentionally disclosed a lease identifier to have the lease and its underlying credential revoked by another tenant. This issue is fixed in version 2.5.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55774)

Affected packages:

- `github.com/openbao/openbao >= 0.1.0, <= 2.5.4`
- `github.com/openbao/openbao < 0.0.0-20260617103932-b20b999dd404`

Patched in:

- `github.com/openbao/openbao 0.0.0-20260617103932-b20b999dd404`

Source: https://github.com/advisories/GHSA-c36x-h252-g9x2

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55774.json)