CVE-2026-55774: OpenBao Cross-namespace Lease Revocation/renewal Vulnerability

LOW
Advisory Identifier: GHSA-c36x-h252-g9x2
Share
CWE-863
Published
Advisory Summary

CVE-2026-55774 is a LOW cross-namespace lease revocation/renewal vulnerability (CWE-863: Incorrect Authorization) affecting OpenBao libraries in the Go ecosystem. The issue involves cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of cve-2026-45808. Remediation is available by upgrading affected packages to version 0.0.0-20260617103932-b20b999dd404.

CVE-2026-55774 at a Glance

CVE Identifier CVE-2026-55774
GHSA Identifier GHSA-c36x-h252-g9x2
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification CWE-863: Incorrect Authorization
Affected Product OpenBao
Package Ecosystem Go
Published Date
Last Updated

How to Fix CVE-2026-55774

To remediate this vulnerability, upgrade all affected OpenBao dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/openbao/openbao fixed: Latest secure release 
Upgrade github.com/openbao/openbao to Latest secure release
github.com/openbao/openbao fixed: 0.0.0-20260617103932-b20b999dd404 
Upgrade github.com/openbao/openbao to 0.0.0-20260617103932-b20b999dd404
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/openbao/openbao

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-55774, inspect your project dependencies for OpenBao:

inspect dependencies for github.com/openbao/openbao

Analyze the terminal output to locate any version of OpenBao in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20260617103932-b20b999dd404), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In OpenBao, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary OpenBao users with access to the `sys/leases/revoke/:lease_id` endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations. ### Impact OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked by a user in another tenant. ### Patch This will be fixed in OpenBao v2.5.5. ### References This vulnerability is similar to but distinct from: - CVE-2026-45808 / GHSA-v8v8-cm84-m686 - CVE-2026-40264 / GHSA-p49j-v9wc-wg57

CVE-2026-55774 Affected OpenBao Versions

2 component(s)
Fixed Versions:
0.0.0-20260617103932-b20b999dd404
Product / Package Ecosystem Affected Versions Fixed Version
github.com/openbao/openbao
golang/github.com/openbao/openbao
Go
≥ 0.1.0
≤ 2.5.4
github.com/openbao/openbao
golang/github.com/openbao/openbao
Go
< 0.0.0-20260617103932-b20b999dd404
0.0.0-20260617103932-b20b999dd404

References

GitHub Advisory / Wiki ADVISORY
https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2
OpenBao Source Repository REPOSITORY
https://github.com/openbao/openbao/pull/3307
Security Fix Commit FIX COMMIT
https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37
OpenBao Source Repository REPOSITORY
https://github.com/openbao/openbao
OpenBao Release RELEASE
https://github.com/openbao/openbao/releases/tag/v2.5.5

Frequently Asked Questions

What is CVE-2026-55774?
CVE-2026-55774 is a security vulnerability in OpenBao involving Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 under CWE-863: Incorrect Authorization.
Which OpenBao versions are affected?
Affected versions include releases prior to 0.0.0-20260617103932-b20b999dd404 across affected packages: github.com/openbao/openbao.
What version fixes CVE-2026-55774?
Upgrading to 0.0.0-20260617103932-b20b999dd404 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/openbao/openbao affected?
Yes, github.com/openbao/openbao is affected in releases prior to Latest secure release, 0.0.0-20260617103932-b20b999dd404. Upgrade your dependency to Latest secure release, 0.0.0-20260617103932-b20b999dd404 or later.
What CWE is associated with CVE-2026-55774?
CVE-2026-55774 is classified under CWE-863: Incorrect Authorization (The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.).
How can I check Go dependencies for CVE-2026-55774?
Run the dependency tree command: 'inspect dependencies for github.com/openbao/openbao'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c36x-h252-g9x2",
  "modified" : "2026-06-19T21:42:04Z",
  "published" : "2026-06-19T21:42:04Z",
  "aliases" : [ "CVE-2026-55774" ],
  "summary" : "OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808",
  "details" : "### Summary\n\nOpenBao users with access to the `sys/leases/revoke/:lease_id` endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations.\n\n### Impact\n\nOpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked by a user in another tenant.\n\n### Patch\n\nThis will be fixed in OpenBao v2.5.5.\n\n### References\n\nThis vulnerability is similar to but distinct from:\n\n- CVE-2026-45808 / GHSA-v8v8-cm84-m686\n- CVE-2026-40264 / GHSA-p49j-v9wc-wg57",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/openbao/openbao"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.1.0"
      }, {
        "last_affected" : "2.5.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/openbao/openbao"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260617103932-b20b999dd404"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openbao/openbao/pull/3307"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/openbao/openbao"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openbao/openbao/releases/tag/v2.5.5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-19T21:42:04Z",
    "nvd_published_at" : null
  }
}