# CVE-2026-55774

## Summary

- **CVE ID:** CVE-2026-55774
- **Severity:** LOW
- **CVSS Score:** 2.1 (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
- **CWE:** CWE-863
- **Published:** Sep 15, 2026
- **Last Modified:** Sep 15, 2026

## Description

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revoke a lease in another namespace when the foreign lease_id was known, bypassing namespace ACL isolation. The affected lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the request namespace, allowing a tenant that intentionally disclosed a lease identifier to have the lease and its underlying credential revoked by another tenant. This issue is fixed in version 2.5.5.

## Affected Products

- openbao — openbao (< 2.5.5)

## References

- [CNA](https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2)
- [CNA](https://github.com/openbao/openbao/pull/3307)
- [CNA](https://github.com/openbao/openbao/pull/3310)
- [CNA](https://github.com/openbao/openbao/commit/9ba1413d793223cca67db12434093a2f25fdc540)
- [CNA](https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37)
- [CNA](https://github.com/openbao/openbao/releases/tag/v2.5.5)
- [CNA](https://github.com/openbao/openbao/releases/tag/v2.6.0)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.44%
- **EPSS Percentile:** 37.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._