CVE-2026-55770: OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished

Executive brief

OpenBao, an open-source secrets management platform, is vulnerable to an authentication bypass when using LDAP. An attacker can craft a specially formatted username to manipulate the underlying directory search, potentially logging in as a different user, such as an administrator. This could allow unauthorized access to sensitive corporate secrets, credentials, and security policies.

Technical details

An LDAP injection vulnerability exists in OpenBao's `sdk/helper/ldaputil/client.go` because it uses `EscapeLDAPValue()` (RFC 4514) instead of `ldap.EscapeFilter()` (RFC 4515) when constructing search filters. While `EscapeLDAPValue()` is appropriate for Distinguished Names, it fails to neutralize characters like `*`, `(`, and `)` which are significant in LDAP filters. A remote attacker with the ability to provide a username at login can inject filter logic to alter the search query. This allows the attacker to match arbitrary user entries, potentially resulting in the issuance of a token bound to a high-privileged account if the LDAP server returns that entry first. The vulnerability is patched in version 2.5.5.

Affected products

• OpenBao OpenBao >= 0.1.0, <= 2.5.4

Timeline

• 2026-06-17: patched: Fix committed to main branch
• 2026-06-19: advisory: GitHub Advisory published

References

• https://api.github.com/users/alcls01111
• https://github.com/alcls01111
• https://api.github.com/users/alcls01111/gists%7B/gist_id%7D
• https://api.github.com/users/alcls01111/repos
• https://avatars.githubusercontent.com/u/57210489?v=4
• https://api.github.com/users/alcls01111/events%7B/privacy%7D