Skip to content
OpenAdvisories

Package · Alpine

openbao

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-33758

    OpenBao has Reflected XSS in its OIDC authentication error message

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_descri…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Critical 9.6
    CVE-2026-33757

    OpenBao lacks user confirmation for OIDC direct callback mode

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authent…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Critical 9.1
    CVE-2025-54997

    OpenBao: Privileged Operator May Execute Code on the Underlying Host

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, some OpenBao deployments intentionally limit privileged API operators from executing system c…

    openbao openbao github.com/openbao/openbao openbao Alpine Go