Skip to content
Heist/ feed
LowFix available

OpenBao's System Backend allows Unauthorized Management of the containing Namespace

Type: advisorySource: OSV1 source record

### Summary A user that is granted namespace management (`/sys/namespaces`) capabilities within a non-root namespace ("the victim namespace") can abuse special handling of the literal path `"root"` in namespace path canonicalization to manage the victim namespace itself. ### Details Several endpoints under `/sys/namespaces/*` accept a namespace path segment that is canonicalized and then appended to the path of the sys mount's containing namespace (set via path prefix or `X-Vault-Namespace` header) to determine the absolute path of the namespace to operate on. Given the special namespace path `"root"` canonicalizes to en empty path (`""`), when passed as `/sys/namespaces/root`, the resulting absolute namespace path remains equal to the sys mount's containing namespace. Given ACLs are evaluated before namespace path canonicalization, this allows users with capabilities on `/sys/namespaces/root` within any given namespace to operate on the namespace itself instead. ### Impact Users that were granted the required capabilities can abuse this vulnerability to: - Look up - Delete - Lock - Patch custom metadata against the namespace containing the system backend they can manage `sys/namespaces/root` in. The exact range of operations that can be performed depends on the specific capabilities granted on said path and any sub-paths such as `/api-lock`. Notably, the root namespace is immutable and cannot be modified, deleted or locked, and is thus unaffected. Also note that users can on

Announced Source revision 1
Original source ↗

GHSA-mwr2-wmgp-crj6

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-mwr2-wmgp-crj6

github.com/openbao/openbao

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
0.0.0-20260617103935-d3c1cc64b1ae

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

github.com/openbao/openbao

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "0.0.0-20260617103935-d3c1cc64b1ae"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/openbao/openbao",
      "purl": "pkg:golang/github.com/openbao/openbao",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mwr2-wmgp-crj6/GHSA-mwr2-wmgp-crj6.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0.1.0"
          },
          {
            "last_affected": "2.5.4"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/openbao/openbao",
      "purl": "pkg:golang/github.com/openbao/openbao",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mwr2-wmgp-crj6/GHSA-mwr2-wmgp-crj6.json"
    }
  }
]
Related CVEs
CVE-2026-55775

Source reference: /aliases

Publisher severity

low

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-55775 · Low

openbao

Event
#15251 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement