Aller au contenu
en Se connecter
9.6 Critique

CVE-2026-33757 OpenBao is an open source identity-based secrets management system

Description

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the `direct` mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional confirmation screen for `direct` type logins that requires manual user interaction in order to finish the authentication. This issue can be worked around either by removing any roles with `callback_mode=direct` or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.

Produits et versions touchés

Produit Versions touchées Corrigé en
openbao 2.5 premières → < 2.5.2 2.5.2
Cryostat 4 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de openbao

Les 43 CVE de openbao →
CVE-2026-115369 OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a… 2.1 Faible CVE-2026-115366 OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged… 2.0 Faible CVE-2026-115365 OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal 7.5 Élevée CVE-2026-115364 OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by… 2.1 Faible
Suivre cette CVE