---
id: CVE-2026-55775
title: OpenBao is an open source identity-based secrets management system
summary: >-
  OpenBao is an open source identity-based secrets management system. Prior to
  2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a
  non-root namespace could exploit special handling of the literal root path in
  namespa…
severity: low
cvss: 2.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-285
vendor: openbao
product: openbao
affected:
  - openbao < 2.5.5
patched:
  - github.com/openbao/openbao 0.0.0-20260617103935-d3c1cc64b1ae
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T19:17:22.777'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55775'
references:
  - url: >-
      https://github.com/openbao/openbao/commit/216b623cdde161eb7798bd095fc874c2174a4dd2
    label: security-advisories@github.com
  - url: >-
      https://github.com/openbao/openbao/commit/d3c1cc64b1ae7f9868b5c3e80b8b11671f0d97ae
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3308'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/pull/3311'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.5.5'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/releases/tag/v2.6.0'
    label: security-advisories@github.com
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-mwr2-wmgp-crj6'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-mwr2-wmgp-crj6'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55775.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-55775'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-55775'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - csaf
  - vex
  - red-hat
  - score-dispute
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T17:38:14.127915Z'
cvssSource: cna
ingestedAt: '2026-06-22T13:35:24.285Z'
scores:
  cna: 2.3
  vendor: 5.4
epss: 0.0036
epssPercentile: 0.2966
---

## Overview

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/* endpoint family can resolve its containing namespace through a path prefix or X-Vault-Namespace header. ACL checks occurred before root canonicalized to an empty path, causing /sys/namespaces/root to resolve to the system backend's containing namespace and allowing permitted lookups, deletion, locking, or custom metadata changes against that direct containing namespace. The root namespace and arbitrary unrelated namespaces are not affected, and available operations depend on the capabilities granted on the path and subpaths such as /api-lock. This issue is fixed in version 2.5.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55775)

Affected packages:

- `github.com/openbao/openbao < 0.0.0-20260617103935-d3c1cc64b1ae`
- `github.com/openbao/openbao >= 0.1.0, <= 2.5.4`

Patched in:

- `github.com/openbao/openbao 0.0.0-20260617103935-d3c1cc64b1ae`

Source: https://github.com/advisories/GHSA-mwr2-wmgp-crj6

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55775.json)