Skip to content
OpenAdvisories

Package · Go

github.com/openbao/openbao

33 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-63132

    OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

    OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to …

    openbao openbao github.com/openbao/openbao Go
  • Critical 9.4
    CVE-2026-33758

    OpenBao has Reflected XSS in its OIDC authentication error message

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_descri…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Critical 9.6
    CVE-2026-33757

    OpenBao lacks user confirmation for OIDC direct callback mode

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authent…

    openbao openbao github.com/openbao/openbao openbao Alpine Go
  • Critical 9.1
    CVE-2025-54997

    OpenBao: Privileged Operator May Execute Code on the Underlying Host

    OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, some OpenBao deployments intentionally limit privileged API operators from executing system c…

    openbao openbao github.com/openbao/openbao openbao Alpine Go