How to fix or mitigate CVE-2026-33758?

Within 24 hours: Inventory all OpenBao deployments and identify instances running versions prior to v2.5.2 with OIDC/JWT authentication enabled and callback_mode=direct configured. Within 7 days: Apply vendor patch by upgrading to OpenBao v2.5.2 or later on all affected systems. Within 30 days: Conduct security audit of Web UI session logs for the past 90 days to detect any unauthorized token usage or anomalous administrative activity.

CVE-2026-33758

Q: What is the CVSS score of CVE-2026-33758?

CVE-2026-33758 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

CRITICAL

Basic XSS (CWE-80)

2026-03-26 https://github.com/openbao/openbao

XSS

9.4

CVSS 4.0 · Vendor: https://github.com/openbao/openbao

Severity by source

Vendor (https://github.com/openbao/openbao) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (https://github.com/openbao/openbao).

CVSS VectorVendor: https://github.com/openbao/openbao

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 18:45 vuln.today

Patch released

Mar 26, 2026 - 18:45 nvd

Patch available

CVE Published

Mar 26, 2026 - 18:37 nvd

CRITICAL 9.4

DescriptionCVE.org

Impact

OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback_mode=direct configured are vulnerable to XSS via the error_description parameter on the page for a failed authentication.

This allows an attacker access to the token used in the Web UI by a victim.

Patches

The error_description parameter has been replaced with a static error message in v2.5.2

Workarounds

The vulnerability can be mitigated by removing any roles with callback_mode set to direct.

AnalysisAI

Cross-site scripting in OpenBao's OIDC/JWT authentication method allows theft of Web UI session tokens when roles are configured with callback_mode=direct. Attackers exploit the unsanitized error_description parameter on failed authentication pages to inject malicious scripts that execute in victims' browsers, granting access to authentication tokens. The vulnerability affects OpenBao installations prior to v2.5.2 and has no public exploit identified at time of analysis, though the technical implementation details are publicly documented in the vendor advisory.

Technical ContextAI

OpenBao is a Go-based secrets management platform forked from HashiCorp Vault. The vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page) exists in the OIDC/JWT authentication method's error handling flow. When authentication fails, the error_description parameter is reflected in the HTML response without proper sanitization or encoding. This classic reflected XSS vector specifically manifests when authentication roles use callback_mode=direct, which processes OAuth/OIDC callback responses directly in the browser rather than through a server-side intermediary. The affected component is identified via CPE as pkg:go/github.com_openbao_openbao, indicating the vulnerability resides in the core OpenBao Go package distributed through GitHub.

RemediationAI

Upgrade OpenBao to version 2.5.2 or later, which replaces the vulnerable error_description parameter with a static error message (see release notes at https://github.com/openbao/openbao/releases/tag/v2.5.2 and fix commit at https://github.com/openbao/openbao/commit/6e2b2dd84f0e47cebc90d6e79609dd5274732662). For environments where immediate patching is not feasible, disable or reconfigure any OIDC/JWT authentication roles that have callback_mode set to direct, effectively eliminating the vulnerable code path. Review authentication role configurations using the OpenBao CLI or API to identify affected roles and migrate them to alternative callback modes. Additional defense-in-depth measures include implementing Content-Security-Policy headers to restrict inline script execution in the Web UI.