OpenBao's System Backend allows Unauthorized Management of the containing Namespace
### Summary A user that is granted namespace management (`/sys/namespaces`) capabilities within a non-root namespace ("the victim namespace") can abuse special handling of the literal path `"root"` in namespace path canonicalization to manage the victim namespace itself. ### Details Several endpoints under `/sys/namespaces/*` accept a namespace path segment that is canonicalized and then appended to the path of the sys mount's containing namespace (set via path prefix or `X-Vault-Namespace` header) to determine the absolute path of the namespace to operate on. Given the special namespace path `"root"` canonicalizes to en empty path (`""`), when passed as `/sys/namespaces/root`, the resulting absolute namespace path remains equal to the sys mount's containing namespace. Given ACLs are evaluated before namespace path canonicalization, this allows users with capabilities on `/sys/namespaces/root` within any given namespace to operate on the namespace itself instead. ### Impact Users that were granted the required capabilities can abuse this vulnerability to: - Look up - Delete - Lock - Patch custom metadata against the namespace containing the system backend they can manage `sys/namespaces/root` in. The exact range of operations that can be performed depends on the specific capabilities granted on said path and any sub-paths such as `/api-lock`. Notably, the root namespace is immutable and cannot be modified, deleted or locked, and is thus unaffected. Also note that users can on
GHSA-mwr2-wmgp-crj6
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-mwr2-wmgp-crj6
github.com/openbao/openbao
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.0.0-20260617103935-d3c1cc64b1ae
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
github.com/openbao/openbao
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260617103935-d3c1cc64b1ae"
}
]
}
],
"package": {
"name": "github.com/openbao/openbao",
"purl": "pkg:golang/github.com/openbao/openbao",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mwr2-wmgp-crj6/GHSA-mwr2-wmgp-crj6.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.1.0"
},
{
"last_affected": "2.5.4"
}
]
}
],
"package": {
"name": "github.com/openbao/openbao",
"purl": "pkg:golang/github.com/openbao/openbao",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mwr2-wmgp-crj6/GHSA-mwr2-wmgp-crj6.json"
}
}
]- Related CVEs
- CVE-2026-55775
Source reference:
/aliases
Publisher severity
low
Source reference: /database_specific/severity
- Event
- #15251 · Revision 1
- Added to Heist Feed
- Publisher date