CVE-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message
Reflected XSS in OpenBao OIDC error messages allows attackers to steal Web UI tokens when specific callback modes are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33758?
CVE-2026-33758 is a critical cross-site scripting vulnerability in openbao, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.
Which versions are affected by CVE-2026-33758?
4 open source packages ship an affected version, including github.com/openbao/openbao and openbao. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openbao/openbao Go | All versions | 0.0.0-20260325133417-6e2b2dd84f0e |
github.com/openbao/openbao Go | All versions | 0.0.0-20260325133417-6e2b2dd84f0e |
github.com/openbao/openbao Go | All versions | 0.0.0-20260325133417-6e2b2dd84f0e |
openbao Bitnami | All versions | 2.5.2 |
Products include Openbao Openbao.
How do I fix CVE-2026-33758?
Upgrade github.com/openbao/openbao to 0.0.0-20260325133417-6e2b2dd84f0e or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-33758 being exploited?
There is no known exploitation of CVE-2026-33758 in the wild and no public exploit code.
Other vulnerabilities in openbao
- CVE-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode
- CVE-2025-54997 OpenBao: Privileged Operator May Execute Code on the Underlying Host
- CVE-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation
- CVE-2025-59043 OpenBao vulnerable to denial of service via malicious JSON request processing
- CVE-2025-54996 OpenBao Root Namespace Operator May Elevate Token Privileges
Sources
Also known as BIT-openbao-2026-33758, GHSA-cpj3-3r2f-xj59, GO-2026-4862.