Answer in brief
CVE-2026-55774 records a Low severity vulnerability in OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808. The current sources do not mark it as known exploited. The current feed maps openbao/openbao (generic), github.com/openbao/openbao (go), github.com/openbao/openbao (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps openbao/openbao (generic), github.com/openbao/openbao (go), github.com/openbao/openbao (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| openbao/openbaogeneric | < 2.5.5 | Not reported |
| github.com/openbao/openbaogo | >=0.1.0,<=2.5.4 | Not reported |
| github.com/openbao/openbaogo | <0.0.0-20260617103932-b20b999dd404 | 0.0.0-20260617103932-b20b999dd404 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known, bypassing namespace ACL isolation. The affected lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the request namespace, allowing a tenant that intentionally disclosed a lease identifier to have the lease and its underlying credential revoked by another tenant. This issue is fixed in version 2.5.5.
Quoted source text, attributed separately from HOL analysis.