Is CVE-2026-55776 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55776 being exploited in the wild.

How severe is CVE-2026-55776?

Medium severity, with a CVSS score of 6.5, published 15 September 2026.

Which products and versions are affected?

github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260617104123-db57c62602b2,introduced=0.1.0, SEMVER:introduced=0.1.0,last_affected=2.5.4; OpenBao >= 0.1.0, <= 2.5.4.

Is there a fix for CVE-2026-55776?

Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260617104123-db57c62602b2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55776 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55776?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55776: OpenBao denial of service via Transit engine key creation

Q: Is there a fix for CVE-2026-55776?

Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260617104123-db57c62602b2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55776 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-55776?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55776 · Severity: medium · CVSS 6.5 · Published 2026-09-15

OpenBao is an open-source security tool used for managing sensitive data like passwords and encryption keys. A vulnerability in its Transit secrets engine allows an authorized user to crash the entire server by sending a specially crafted key-creation request. This results in a complete service outage, preventing all users and applications from accessing their stored secrets until the server is restarted.

Technologies: github.com/openbao/openbao (Go), OpenBao. Vendors: Go, OpenBao.

Quick answers

Is CVE-2026-55776 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55776 being exploited in the wild.
How severe is CVE-2026-55776?: Medium severity, with a CVSS score of 6.5, published 15 September 2026.
Which products and versions are affected?: github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260617104123-db57c62602b2,introduced=0.1.0, SEMVER:introduced=0.1.0,last_affected=2.5.4; OpenBao >= 0.1.0, <= 2.5.4.
Is there a fix for CVE-2026-55776?: Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260617104123-db57c62602b2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55776 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55776?: Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openbao/openbao (Go): upgrade to 0.0.0-20260617104123-db57c62602b2 or later
```
go get github.com/openbao/openbao@v0.0.0-20260617104123-db57c62602b2
```

Technical details

A Reachable Assertion (CWE-617) vulnerability exists in the OpenBao Transit secrets engine. When an authenticated user with write permissions to the 'transit/keys/*' path issues a key-creation request that specifies an asymmetric key type (such as RSA, ECDSA, or Ed25519) while setting the 'derived' parameter to true, the server process panics and terminates with exit code 2. This occurs because the key-derivation logic incorrectly assumes a symmetric key context and fails to handle asymmetric types gracefully. An attacker can exploit this to cause a persistent denial-of-service (DoS) across the entire cluster. The issue is addressed in version 2.5.5 and specific patched commit builds.

Affected products

OpenBao OpenBao >= 0.1.0, <= 2.5.4

Identifiers

CVE-2026-55776
GHSA-8w8f-r2xv-4q4j
GO-2026-5267

Timeline

2026-06-19: disclosed
2026-06-19: advisory
2026-06-17: patched: Patched in commit db57c62

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.