Reachable assertion in OpenBao - CVE-2026-55776
Published: August 19, 2026
Vulnerability identifier: #VU144301
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55776
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to reachable assertion in the transit engine key-creation handler when processing a key-creation request with derived=true for asymmetric key types. A remote user can send a specially crafted key-creation request to cause a denial of service.
The issue can terminate the entire cluster, and both JSON and HCL request formats can trigger it.
Affected software
OpenBao
Fedora
openbao
Fedora
openbao
How to mitigate CVE-2026-55776
Install security update from vendor's website.
OpenBao - update to 2.5.5
openbao - addressed in versions 2.5.5-1.el8, 2.5.5-1.el9, 2.5.5-1.el10_2, 2.5.5-1.el10_3, 2.5.5-1.fc43, 2.5.5-1.fc44
openbao - addressed in versions 2.5.5-1.el8, 2.5.5-1.el9, 2.5.5-1.el10_2, 2.5.5-1.el10_3, 2.5.5-1.fc43, 2.5.5-1.fc44