Answer in brief
CVE-2026-55776 records a Medium severity vulnerability in OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types. The current sources do not mark it as known exploited. The current feed maps openbao/openbao (generic), github.com/openbao/openbao (go), github.com/openbao/openbao (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps openbao/openbao (generic), github.com/openbao/openbao (go), github.com/openbao/openbao (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| openbao/openbaogeneric | < 2.5.5 | Not reported |
| github.com/openbao/openbaogo | >=0.1.0,<=2.5.4 | Not reported |
| github.com/openbao/openbaogo | <0.0.0-20260617104123-db57c62602b2 | 0.0.0-20260617104123-db57c62602b2 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy creation path in builtin/logical/transit/backend.go and sdk/helper/keysutil/policy.go could reach an error path that double-unlocked a mutex while handling this invalid asymmetric derived-key combination, causing a panic, no HTTP response, process exit, and denial of service. JSON and HCL key-creation requests can express the triggering combination. This issue is fixed in version 2.5.5.
Quoted source text, attributed separately from HOL analysis.