CVE-2026-55770 Overview
OpenBao is an open source identity-based secrets management system. CVE-2026-55770 is an LDAP injection vulnerability [CWE-90] in versions prior to 2.5.5. The flaw resides in sdk/helper/ldaputil/client.goGetUserDN, where OpenBao called EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, in a code path that required RFC 4515 LDAP search-filter escaping. When the LDAP authentication backend is configured for Active Directory UPNDomain or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters can alter the search predicate and select a different directory entry.
Critical Impact
A token issued after successful bind can be associated with another LDAP identity, granting access to secrets, policies, or modification capabilities assigned to that identity.
Affected Products
- OpenBao versions prior to 2.5.5
- OpenBao LDAP authentication backend with Active Directory UPNDomain configuration
- OpenBao LDAP authentication backend with UserDN and UserAttr binding
Discovery Timeline
- 2026-09-15 - CVE-2026-55770 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-55770
Vulnerability Analysis
The vulnerability stems from mixing two distinct LDAP escaping standards. RFC 4514 defines escaping for distinguished names (DNs), while RFC 4515 defines escaping for LDAP search filters. OpenBao's GetUserDN function used EscapeLDAPValue to sanitize user-supplied input that was subsequently interpolated into an LDAP search filter. Because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter, characters such as *, (, ), \, and NUL bytes pass through untouched. An attacker can submit a crafted username that alters the intended search predicate. The resulting directory query can match a different entry than the one requested. When OpenBao issues a token for the returned identity, that token inherits the policies and secret access of the substituted account.
Root Cause
The root cause is the use of EscapeLDAPValue where ldap.EscapeFilter was required. The two functions target different LDAP syntactic contexts. Applying DN escaping to search-filter input leaves filter metacharacters unsanitized, enabling injection into the LDAP query.
Attack Vector
Exploitation requires the OpenBao LDAP authentication backend to be configured against an Active Directory UPNDomain path or UserDN and UserAttr binding. An authenticated LDAP-capable attacker submits a username containing filter metacharacters through the standard OpenBao login endpoint. High attack complexity reflects the specific configuration prerequisites and directory content required to substitute a higher-privileged entry.
// Patched file: builtin/logical/openldap/client.go
// Removal of the vulnerable ldaputil import as part of the fix
"github.com/go-ldap/ldap/v3"
"github.com/go-ldap/ldif"
"github.com/hashicorp/go-hclog"
- "github.com/openbao/openbao/sdk/v2/helper/ldaputil"
"github.com/openbao/openbao/builtin/logical/openldap/client"
)
Source: OpenBao Commit 10b7825
Detection Methods for CVE-2026-55770
Indicators of Compromise
- LDAP authentication events where the resolved bind DN does not correspond to the submitted username.
- OpenBao audit log entries showing token issuance for an identity that differs from the authenticated principal.
- LDAP server query logs containing filter metacharacters such as *, (, or ) in username fields.
Detection Strategies
- Enable OpenBao audit devices and correlate auth/ldap/login/* requests with the returned entity identifier to detect identity mismatches.
- Inspect directory server logs for anomalous search filters originating from OpenBao service accounts.
- Alert on token issuance events tied to privileged LDAP groups following logins from low-privilege accounts.
Monitoring Recommendations
- Forward OpenBao audit logs and Active Directory security events to a centralized analytics pipeline for correlation.
- Baseline expected LDAP search filter patterns from OpenBao and alert on deviations.
- Track OpenBao version inventory to identify hosts running builds earlier than 2.5.5.
How to Mitigate CVE-2026-55770
Immediate Actions Required
- Upgrade OpenBao to version 2.5.5 or 2.6.0, which apply the corrected filter escaping.
- Audit issued tokens created after the LDAP backend was enabled and revoke any tied to unexpected identities.
- Review OpenBao LDAP authentication configuration to confirm whether UPNDomain or UserDN and UserAttr binding is in use.
Patch Information
The fix removes reliance on ldaputil escaping in the OpenLDAP client path and applies ldap.EscapeFilter semantics. See the OpenBao Security Advisory GHSA-6mwx-4547-5vc9, OpenBao Pull Request #3306, OpenBao Pull Request #3313, OpenBao Release v2.5.5, and OpenBao Release v2.6.0.
Workarounds
- Restrict network access to the OpenBao API so that only trusted clients can reach the LDAP login endpoint.
- Enforce strict LDAP directory ACLs that limit the entries returned by service-account searches.
- Require additional authentication factors or use non-LDAP auth methods until the patch is deployed.
# Verify OpenBao version and upgrade
bao version
# Upgrade to a fixed release (2.5.5 or 2.6.0) using your package manager or binary distribution
# Then restart the service
systemctl restart openbao
# Review LDAP auth configuration for UPNDomain or UserDN/UserAttr binding
bao read auth/ldap/config
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
