9.4
Critique
CVE-2026-33758 OpenBao is an open source identity-based secrets management system
Description
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| openbao 2.5 | premières → < 2.5.2 | 2.5.2 |
| Cryostat 4 | Versions non publiées |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de openbao
Les 43 CVE de openbao →
CVE-2026-115369
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a…
2.1
Faible
CVE-2026-115366
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged…
2.0
Faible
CVE-2026-115365
OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
7.5
Élevée
CVE-2026-115364
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by…
2.1
Faible