CVE-2026-55776

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.5.2 through 2.5.4

Description An authenticated user with write access to the transit/keys/* endpoint can cause a denial-of-service by crashing the server. This occurs when a key-creation request is sent combining an asymmetric type (such as rsa-*, ecdsa-*, or ed25519) with the derived variable set to true. The server fails to return an HTTP response and the process terminates with exit code 2, potentially crashing the entire cluster. The issue stems from the transit engine assuming a symmetric key shape when key derivation is enabled, leading to a panic when an asymmetric type is provided.

Recommendations For OpenBao versions 2.5.2 through 2.5.4, validate the combination of type and derived at the start of the create-key handler and reject requests with a 400 error if derived: true is used with any non-symmetric type. As a temporary workaround, avoid setting the derived variable to true when creating keys with asymmetric types in the transit/keys/* endpoint.