Is CVE-2026-33758 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33758 being exploited in the wild.

How severe is CVE-2026-33758?

Medium severity, with a CVSS score of 6.1, published 27 March 2026.

Which products and versions are affected?

github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260325133417-6e2b2dd84f0e; OpenBao < 2.5.2.

Is there a fix for CVE-2026-33758?

Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260325133417-6e2b2dd84f0e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33758 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33758?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33758: OpenBao reflected XSS in OIDC authentication callback

Q: Is there a fix for CVE-2026-33758?

Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260325133417-6e2b2dd84f0e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33758 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33758?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33758 · Severity: medium · CVSS 6.1 · Published 2026-03-27

OpenBao, an open-source secrets management system, is vulnerable to a security flaw in its web-based login process. If an attacker tricks a user into clicking a malicious link during a failed login attempt, they can execute unauthorized scripts in the user's browser. This could allow the attacker to steal sensitive authentication tokens, potentially gaining full access to the user's managed secrets and the OpenBao system.

Technologies: github.com/openbao/openbao (Go), OpenBao. Vendors: Go, OpenBao.

Quick answers

Is CVE-2026-33758 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33758 being exploited in the wild.
How severe is CVE-2026-33758?: Medium severity, with a CVSS score of 6.1, published 27 March 2026.
Which products and versions are affected?: github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260325133417-6e2b2dd84f0e; OpenBao < 2.5.2.
Is there a fix for CVE-2026-33758?: Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260325133417-6e2b2dd84f0e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33758 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33758?: Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openbao/openbao (Go): upgrade to 0.0.0-20260325133417-6e2b2dd84f0e or later
```
go get github.com/openbao/openbao@v0.0.0-20260325133417-6e2b2dd84f0e
```

Technical details

OpenBao is vulnerable to a reflected Cross-Site Scripting (XSS) vulnerability within its OIDC/JWT authentication handler. The flaw exists in the handling of the `error_description` parameter on the failed authentication page when a role is configured with `callback_mode=direct`. Because this parameter was reflected into the HTML template without proper sanitization or encoding, a remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the OpenBao Web UI. This can lead to the theft of the victim's sensitive authentication tokens. The issue is addressed in version 2.5.2 by replacing the dynamic parameter with a static error message and improving output encoding. A temporary mitigation is to disable the `direct` callback mode for all OIDC/JWT roles.

Affected products

OpenBao OpenBao < 2.5.2

Identifiers

CVE-2026-33758
GHSA-cpj3-3r2f-xj59
GO-2026-4862

Timeline

2026-03-25: patched: Fixed in version 2.5.2
2026-03-27: advisory: GHSA-cpj3-3r2f-xj59 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.