# CVE-2026-55776: OpenBao denial of service via Transit engine key creation

Source: https://junglewise.ai/threats/cve-2026-55776-openbao-denial-of-service-via-transit-engine-key-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-06-19  
License: CC BY 4.0 with a link back

CVE-2026-55776 · Severity: medium · CVSS 6.5 · Published 2026-09-15

OpenBao is an open-source security tool used for managing sensitive data like passwords and encryption keys. A vulnerability in its Transit secrets engine allows an authorized user to crash the entire server by sending a specially crafted key-creation request. This results in a complete service outage, preventing all users and applications from accessing their stored secrets until the server is restarted.

Technologies: [github.com/openbao/openbao (Go)](https://junglewise.ai/threats/technologies/github-com-openbao-openbao), [OpenBao](https://junglewise.ai/threats/technologies/openbao). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenBao](https://junglewise.ai/threats/vendors/openbao).

## Quick answers

**Is CVE-2026-55776 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55776 being exploited in the wild.

**How severe is CVE-2026-55776?** Medium severity, with a CVSS score of 6.5, published 15 September 2026.

**Which products and versions are affected?** github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260617104123-db57c62602b2,introduced=0.1.0, SEMVER:introduced=0.1.0,last_affected=2.5.4; OpenBao >= 0.1.0, <= 2.5.4.

**Is there a fix for CVE-2026-55776?** Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260617104123-db57c62602b2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55776 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55776?** Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openbao/openbao (Go): upgrade to 0.0.0-20260617104123-db57c62602b2 or later

  ```sh
  go get github.com/openbao/openbao@v0.0.0-20260617104123-db57c62602b2
  ```


## Technical details

A Reachable Assertion (CWE-617) vulnerability exists in the OpenBao Transit secrets engine. When an authenticated user with write permissions to the 'transit/keys/*' path issues a key-creation request that specifies an asymmetric key type (such as RSA, ECDSA, or Ed25519) while setting the 'derived' parameter to true, the server process panics and terminates with exit code 2. This occurs because the key-derivation logic incorrectly assumes a symmetric key context and fails to handle asymmetric types gracefully. An attacker can exploit this to cause a persistent denial-of-service (DoS) across the entire cluster. The issue is addressed in version 2.5.5 and specific patched commit builds.

## Affected products

- OpenBao OpenBao >= 0.1.0, <= 2.5.4

## Identifiers

- CVE-2026-55776
- GHSA-8w8f-r2xv-4q4j
- GO-2026-5267

## Timeline

- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-17: patched: Patched in commit db57c62

## References

- [https://api.github.com/users/SahilKumar000](https://api.github.com/users/SahilKumar000)
- [https://github.com/SahilKumar000](https://github.com/SahilKumar000)
- [https://api.github.com/users/SahilKumar000/gists%7B/gist_id%7D](https://api.github.com/users/SahilKumar000/gists%7B/gist_id%7D)
- [https://api.github.com/users/SahilKumar000/repos](https://api.github.com/users/SahilKumar000/repos)
- [https://avatars.githubusercontent.com/u/119723019?v=4](https://avatars.githubusercontent.com/u/119723019?v=4)
- [https://api.github.com/users/SahilKumar000/events%7B/privacy%7D](https://api.github.com/users/SahilKumar000/events%7B/privacy%7D)

## Related threats

- [OpenBao policy cache incorrect authorization via namespace traversal](https://junglewise.ai/threats/cve-2026-115365-openbao-from-2-3-0-before-2-6-3-contains-an-incorrect)
- [OpenBao ACL bypass in policy denial evaluation](https://junglewise.ai/threats/cve-2026-115361-openbao-before-2-6-3-contains-an-acl-bypass-vulnerability-that)
- [OpenBao Kubernetes Auth token renewal on revoked credentials](https://junglewise.ai/threats/cve-2026-115356-openbao-before-2-6-4-and-2-7-x-before-2-7-1-does-not-verify-when)
- [OpenBao Agent information disclosure via stdout in exec rendering mode](https://junglewise.ai/threats/cve-2026-77285-openbao-agent-information-disclosure-via-stdout-in-exec-rendering)
- [OpenBao recovery mode timing attack token leakage](https://junglewise.ai/threats/cve-2026-63132-openbao-recovery-mode-timing-attack-token-leakage)