6.5

CVE-2026-55776

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy creation path in builtin/logical/transit/backend.go and sdk/helper/keysutil/policy.go could reach an error path that double-unlocked a mutex while handling this invalid asymmetric derived-key combination, causing a panic, no HTTP response, process exit, and denial of service. JSON and HCL key-creation requests can express the triggering combination. This issue is fixed in version 2.5.5.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstelleropenbao
≫
Produkt openbao
Version < 2.5.5
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.386
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

https://github.com/openbao/openbao/releases/tag/v2.5.5
https://github.com/openbao/openbao/releases/tag/v2.6.0
https://github.com/openbao/openbao/security/advisories/GHSA-8w8f-r2xv-4q4j
https://github.com/openbao/openbao/pull/3309
https://github.com/openbao/openbao/pull/3312
https://github.com/openbao/openbao/commit/bb17827f3e33779a10166f7d0e61b191c0facef9
https://github.com/openbao/openbao/commit/db57c62602b25da12951f3f0edb888e7c4da61e5