CVE-2026-55770

Name of the Vulnerable Software and Affected Versions OpenBao (affected versions not specified)

Description An issue exists in the shared LDAP utility library sdk/helper/ldaputil/client.go used by the LDAP authentication backend and OpenLDAP secrets engine. The GetUserDN() function incorrectly uses EscapeLDAPValue() instead of ldap.EscapeFilter() when constructing LDAP search filters and bind DNs. While EscapeLDAPValue() follows RFC 4514 for Distinguished Name (DN) components, it fails to escape characters required by RFC 4515 for search filters, such as *, (, ), ``, and NUL (x00).

An attacker can exploit this by providing a specially crafted username during login to perform an LDAP injection. By manipulating the filter logic, an attacker can bypass intended constraints and potentially match arbitrary user entries, such as administrative accounts. If the LDAP server returns an administrative entry, the resulting token may be bound to that admin entity, granting unauthorized access to secrets and policies.

Recommendations Replace the EscapeLDAPValue function with ldap.EscapeFilter in the filter construction paths within sdk/helper/ldaputil/client.go. Apply the principle of least privilege to LDAP service accounts used by the software. Use UserFilter with explicit attribute constraints to limit the search scope.