CVE-2026-55775: OpenBao Privilege Escalation Vulnerability

CVE-2026-55775 Overview

CVE-2026-55775 affects OpenBao, an open source identity-based secrets management system. The vulnerability exists in the namespace path canonicalization logic prior to version 2.5.5. Users granted capabilities on /sys/namespaces/root within a non-root namespace can exploit the special handling of the literal root path string. The flaw allows permitted lookups, deletion, locking, or custom metadata changes against the direct containing namespace. This constitutes an improper authorization weakness classified as [CWE-285].

Critical Impact
Authenticated users in a non-root namespace can perform unauthorized operations on their parent containing namespace, including deletion, locking, and metadata modification.

Affected Products

OpenBao versions prior to 2.5.5
OpenBao core namespace subsystem (helper/namespace/namespace.go)
Deployments using non-root namespaces with delegated /sys/namespaces/* capabilities

Discovery Timeline

2026-09-15 - CVE-2026-55775 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-55775

Vulnerability Analysis

The vulnerability stems from how OpenBao canonicalizes namespace paths before performing Access Control List (ACL) checks. The /sys/namespaces/* endpoint family resolves its containing namespace through either a path prefix or the X-Vault-Namespace header. ACL checks executed before the literal string root was canonicalized to an empty path. As a result, a request targeting /sys/namespaces/root from within a non-root namespace resolved to the system backend's containing namespace. The scope of unauthorized actions depends on capabilities granted on the path and subpaths such as /api-lock.

Root Cause

The canonicalization function in helper/namespace/namespace.go treated both . and root as equivalents that should return an empty path. This special-case handling allowed a namespace-scoped identifier of root to escape the intended namespace boundary. The root namespace itself and arbitrary unrelated namespaces are not affected, since the resolution only maps to the direct containing namespace of the calling context.

Attack Vector

An authenticated user in a child namespace who holds capabilities on /sys/namespaces/root can issue namespace management operations against the parent namespace. Available operations include read, delete, lock, unlock, and custom metadata modification, depending on granted permissions.

// Patch: helper/namespace/namespace.go
	// Remove duplicate slashes and any ../ values if present.
	nsPath = path.Clean(nsPath)

-	if nsPath == "." || nsPath == "root" {
+	if nsPath == "." {
		return ""
	}

Source: OpenBao commit d3c1cc6

Detection Methods for CVE-2026-55775

Indicators of Compromise

Audit log entries showing requests to /sys/namespaces/root originating from within a non-root namespace context
Unexpected delete, lock, or patch operations against parent namespace metadata
Requests carrying an X-Vault-Namespace header referencing root from child namespace tokens

Detection Strategies

Enable and centralize OpenBao audit device logs, then alert on any write or delete operation targeting /sys/namespaces/root
Correlate the calling token's namespace with the resolved target namespace to flag cross-namespace management operations
Review policy assignments that grant update, delete, or sudo on /sys/namespaces/* within non-root namespaces

Monitoring Recommendations

Forward OpenBao audit logs to a SIEM and build detections for anomalous namespace lifecycle operations
Track api-lock and api-unlock events, since lock manipulation can produce denial-of-service conditions against the parent namespace
Baseline normal namespace administration activity and alert on deviations from known administrator identities

How to Mitigate CVE-2026-55775

Immediate Actions Required

Upgrade OpenBao to version 2.5.5 or 2.6.0 as tracked in the GHSA-mwr2-wmgp-crj6 advisory
Audit all policies that grant capabilities on /sys/namespaces/* within non-root namespaces and remove unnecessary grants
Rotate credentials or revoke tokens for identities that had access to /sys/namespaces/root in a child namespace

Patch Information

The fix removes the special-case handling of the literal string root in the namespace canonicalization logic. The change is contained in pull request #3308 and backported via pull request #3311. Fixed releases are available as OpenBao v2.5.5 and OpenBao v2.6.0.

Workarounds

Restrict policies so that no non-root namespace identity holds create, update, delete, or sudo capabilities on /sys/namespaces/root or its subpaths such as /api-lock
Deny requests carrying an X-Vault-Namespace header value of root originating from child namespace contexts at an upstream proxy
Constrain namespace administration to tokens issued in the root namespace only

bash

# Verify installed OpenBao version and upgrade
bao version
# Upgrade to a fixed release (2.5.5 or 2.6.0) per platform packaging

# Review policies granting namespace management in child namespaces
bao policy list
bao policy read <policy-name> | grep -E 'sys/namespaces'