PT-2026-28530 · Openbao+1 · Openbao+1

Gianklug · Published 2026-03-26 · Updated 2026-05-29 · CVE-2026-33758

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.2

Description OpenBao, an open source identity-based secrets management system, is susceptible to Reflected Cross-Site Scripting (XSS) through the error description parameter during failed authentication attempts when an OIDC/JWT authentication method is enabled and a role is configured with callback mode=direct. This allows an attacker to gain access to the token used in the Web UI by a victim. The issue is addressed by replacing the error description parameter with a static error message. The API endpoint involved in the vulnerability is not explicitly mentioned. The vulnerable parameter is error description.

Recommendations Versions prior to 2.5.2 should be updated to version 2.5.2 or later. As a mitigation, remove any roles with callback mode set to direct.

Exploit

Fix

XSS

Improper Encoding or Escaping of Output

RCE

Weakness Enumeration

CWE-79

CWE-116

CWE-80

CWE-20

Related Identifiers

CVE-2026-33758

GHSA-CPJ3-3R2F-XJ59

GO-2026-4862

OPENSUSE-SU-2026:10438-1

SUSE-SU-2026:1135-1

Affected Products

Openbao

Red Os

References · 155

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33758.json · Exploit
• https://github.com/openbao/openbao/commit/6e2b2dd84f0e47cebc90d6e79609dd5274732662 · Patch
• https://github.com/openbao/openbao/pull/2709 · Patch
• https://github.com/openbao/openbao/security/advisories/GHSA-cpj3-3r2f-xj59 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10438-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpj3-3r2f-xj59 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33758 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33758 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://github.com/openbao/openbao/releases/tag/v2.5.2 · Note
• https://suse.com/security/cve/CVE-2026-33503 · Note
• https://suse.com/security/cve/CVE-2026-33621 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-openbao-cve-2026-33758-8.0 · Note