SB2026081965 - Fedora EPEL 8 update for openbao
Published: August 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) LDAP injection (CVE-ID: CVE-2026-55770)
CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and modify data by impersonating a different LDAP user.
The vulnerability exists due to improper neutralization of special elements used in an LDAP query in sdk/helper/ldaputil/client.go when constructing LDAP search filters from the username field during login. A remote user can supply a specially crafted username value to disclose sensitive information and modify data by causing OpenBao to bind a token to a different LDAP user.
Exploitation requires the LDAP authentication backend to be configured and the deployment to use Active Directory or UserDN/UserAttr binding.
2) Incorrect authorization (CVE-ID: CVE-2026-55774)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to revoke leases across namespaces.
The vulnerability exists due to incorrect authorization in the sys/leases/revoke/:lease_id endpoint when processing a lease identifier in the request path. A remote privileged user can submit a known lease identifier to revoke leases across namespaces.
A known lease identifier is required for exploitation, and the issue can revoke the underlying credential associated with the lease.
3) Improper Authorization (CVE-ID: CVE-2026-55775)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform unauthorized management operations on the containing namespace.
The vulnerability exists due to improper authorization in /sys/namespaces/* endpoints when processing the literal \"root\" namespace path during namespace path canonicalization. A remote user can send a request to /sys/namespaces/root to perform unauthorized management operations on the containing namespace.
The issue only affects non-root namespaces, and the exact operations depend on the capabilities granted on the path and related sub-paths such as /api-lock. The root namespace is unaffected, and exploitation is limited to the direct containing namespace rather than arbitrary namespaces.
4) Reachable assertion (CVE-ID: CVE-2026-55776)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to reachable assertion in the transit engine key-creation handler when processing a key-creation request with derived=true for asymmetric key types. A remote user can send a specially crafted key-creation request to cause a denial of service.
The issue can terminate the entire cluster, and both JSON and HCL request formats can trigger it.
Remediation
Install update from vendor's website.