Vulnerability in OpenBao's Secrets Management System Affects LDAP Authentication

CVE-2026-55770

What is CVE-2026-55770?

OpenBao, an open-source identity-based secrets management system, prior to version 2.5.5, has a vulnerability in its LDAP authentication mechanism. The issue arises from the incorrect handling of LDAP filter metacharacters in user inputs, which can lead to unauthorized access. Specifically, the use of the EscapeLDAPValue function allows attacker-controlled usernames to manipulate search predicates, potentially providing access to secrets or sensitive capabilities associated with other LDAP identities. The vulnerability is mitigated in version 2.5.5, which requires users to update to this version to secure their installations.

References