← Vulnerability feed

Vulnerability record · CVE-2026-33758 · published 27 March 2026

CVE-2026-33758: Openbao improper input validation vulnerability

Openbao · Openbao

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.

9.4 CVSS 4.0 Critical EPSS 0.45% · top 63.5% CWE-20 · Improper input validationCWE-79 · Cross-site scripting
9.4CVSS 4.0 base score
0.45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References
15 Jul 2026Last modified by NVD

Description

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/openbao/openbao/commit/6e2b2dd84f0e47cebc90d6e79609dd5274732662 Patch
https://github.com/openbao/openbao/pull/2709 Issue TrackingPatch
https://github.com/openbao/openbao/releases/tag/v2.5.2 ProductRelease Notes
https://github.com/openbao/openbao/security/advisories/GHSA-cpj3-3r2f-xj59 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33758
https://bugzilla.redhat.com/show_bug.cgi?id=2452294
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33758.json

Track CVE-2026-33758 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-2048Hashicorp vault improper certificate validation vulnerabilityVault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certifi…EPSS 0.45%9.1CVE-2025-54997Openbao code injection vulnerabilityOpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions …EPSS 0.38%8.8CVE-2024-7594Hashicorp vault incorrect permission assignment vulnerabilityVault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields o…EPSS 0.27%8.3CVE-2026-33757Openbao vulnerabilityOpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when loggin…EPSS 0.61%7.5CVE-2025-64761Openbao vulnerabilityOpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsys…EPSS 0.36%7.5CVE-2025-59043Openbao uncontrolled resource consumption vulnerabilityOpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significa…EPSS 0.69%7.5CVE-2024-8185Hashicorp vault vulnerabilityVault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack t…EPSS 0.48%7.2CVE-2025-54996Openbao improper privilege management vulnerabilityOpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions …EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2026-33758), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.