CVE-2026-55776
Description
A flaw was found in OpenBao. An authenticated user with write access to the transit secrets engine could trigger a server crash by creating a key with specific asymmetric key types and a 'derived' parameter set to true. This vulnerability, caused by a double-unlock of a mutex, leads to a denial of service, making the server unresponsive.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Other
Technical Impact: DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands; Modify Memory; Other
Depending on the locking being used, an unlock operation might not have any adverse effects. When effects exist, the most common consequence will be a corruption of the state of the product, possibly leading to a crash or exit; depending on the implementation of the unlocking, memory corruption or code execution could occur.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
