{"id":"EUVD-2026-78683","enisaUuid":"8ae98f0e-842e-335a-b922-9287f9fbf09f","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5.","datePublished":"Sep 15, 2026, 3:44:35 PM","dateUpdated":"Sep 17, 2026, 11:59:03 AM","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9\nhttps://github.com/openbao/openbao/pull/3306\nhttps://github.com/openbao/openbao/pull/3313\nhttps://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659\nhttps://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c\nhttps://github.com/openbao/openbao/releases/tag/v2.5.5\nhttps://github.com/openbao/openbao/releases/tag/v2.6.0\n","aliases":"CVE-2026-55770\nGHSA-6mwx-4547-5vc9\n","assigner":"GitHub_M","epss":0.52,"enisaIdProduct":[{"id":"56a60928-3980-31a4-b9e1-02304793aa4e","product":{"name":"openbao","vendor":{"name":"openbao"}},"product_version":"\u003c 2.5.5"}],"enisaIdVendor":[{"id":"e4a8ef9f-c688-3cfe-9dc1-f87a04e739f0","vendor":{"name":"openbao"}}],"enisaIdVulnerability":[{"id":"3ff594ea-2839-31f9-a15d-6fc553a7798f","vulnerability":{"id":"GHSA-6mwx-4547-5vc9","description":"OpenBao: LDAPi ldaputil (wrong escape func)","datePublished":"Jun 19, 2026, 9:42:01 PM","dateUpdated":"Jun 19, 2026, 9:42:01 PM","baseScore":0.0,"references":"https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9\nhttps://github.com/openbao/openbao/pull/3306\nhttps://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659\nhttps://github.com/openbao/openbao\nhttps://github.com/openbao/openbao/releases/tag/v2.5.5\n","enisa_id":"EUVD-2026-78683\n","aliases":"GHSA-6mwx-4547-5vc9\nCVE-2026-55770\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"aff02659-f4bc-3c64-bb5d-11ef646595ae","vulnerability":{"id":"CVE-2026-55770","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5.","datePublished":"Sep 15, 2026, 3:44:35 PM","dateUpdated":"Sep 17, 2026, 11:59:03 AM","status":"PUBLISHED","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9\nhttps://github.com/openbao/openbao/pull/3306\nhttps://github.com/openbao/openbao/pull/3313\nhttps://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659\nhttps://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c\nhttps://github.com/openbao/openbao/releases/tag/v2.5.5\nhttps://github.com/openbao/openbao/releases/tag/v2.6.0\n","enisa_id":"EUVD-2026-78683\n","assigner":"GitHub_M","epss":0.52,"dataProcessed":"Oct 30, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"aaca4580-1014-33e1-9d8b-affdb612bdc0","product":{"name":"openbao","vendor":{"name":"openbao"}},"product_version":"\u003c 2.5.5"}],"vulnerabilityVendor":[{"id":"812b74e5-d9c7-3430-8e00-46f6abf2c861","vendor":{"name":"openbao"}}]}}],"enisaIdAdvisory":[]}