Executive brief
OpenBao is an open-source security tool used for managing sensitive data like passwords and encryption keys. A vulnerability in its Transit secrets engine allows an authorized user to crash the entire server by sending a specially crafted key-creation request. This results in a complete service outage, preventing all users and applications from accessing their stored secrets until the server is restarted.
Technical details
A Reachable Assertion (CWE-617) vulnerability exists in the OpenBao Transit secrets engine. When an authenticated user with write permissions to the 'transit/keys/*' path issues a key-creation request that specifies an asymmetric key type (such as RSA, ECDSA, or Ed25519) while setting the 'derived' parameter to true, the server process panics and terminates with exit code 2. This occurs because the key-derivation logic incorrectly assumes a symmetric key context and fails to handle asymmetric types gracefully. An attacker can exploit this to cause a persistent denial-of-service (DoS) across the entire cluster. The issue is addressed in version 2.5.5 and specific patched commit builds.
Affected products
- OpenBao OpenBao >= 0.1.0, <= 2.5.4
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-17: patched: Patched in commit db57c62
References
- https://api.github.com/users/SahilKumar000
- https://github.com/SahilKumar000
- https://api.github.com/users/SahilKumar000/gists%7B/gist_id%7D
- https://api.github.com/users/SahilKumar000/repos
- https://avatars.githubusercontent.com/u/119723019?v=4
- https://api.github.com/users/SahilKumar000/events%7B/privacy%7D