OpenBao has Reflected XSS in its OIDC authentication error message

Impact OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a...

OpenBao lacks user confirmation for OIDC direct callback mode

Impact OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the...

GHSA-7Q7G-X6VG-XPC3 OpenBao lacks user confirmation for OIDC direct callback mode

Impact OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the...

OPENSUSE-SU-2026:10438-1 openbao-2.5.2-1.1 on GA media

These are all security issues fixed in the openbao-2.5.2-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-28530

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.2 Description OpenBao, an open source identity-based secrets management system, is susceptible to Reflected Cross-Site Scripting XSS through the error description parameter during failed authentication attempts wh...

PT-2026-28529

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.2 Description OpenBao, an open source identity-based secrets management system, does not prompt for user confirmation when logging in via JWT/OIDC with a role configured with callback mode set to direct. This allo...

OPENSUSE-SU-2026:10396-1 openbao-2.5.1-1.1 on GA media

These are all security issues fixed in the openbao-2.5.1-1.1 package on the GA media of openSUSE Tumbleweed...

Privilege Escalation

OpenBao is vulnerable to Privilege Escalation. The vulnerability is due to improper access control in the identity group subsystem, which allows a privileged operator to assign root policies to group identities and escalate permissions...

ROS-20260319-73-0021

Vulnerability in openbao related to incorrect privilege assignment. Exploitation of the vulnerability could allow an attacker to escalate privileges...

CLEANSTART-2026-HF45264 filippo

Multiple security vulnerabilities affect the openbao-fips package. filippo. See references for individual vulnerability details...

CLEANSTART-2026-TJ33788 Within HostnameError

Multiple security vulnerabilities affect the openbao-fips package. Within HostnameError. See references for individual vulnerability details...

ROS-20260209-73-0031

Vulnerability in openbao related to uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

Improper Authentication And Authorization

github.com/openbao/openbao-plugins is vulnerable to Improper Authentication and Authorization. The vulnerability is due to insufficient validation of IAM role identity across AWS accounts, which allows an attacker from an untrusted account to impersonate a same-named role in a trusted account and...

CLEANSTART-2026-KF66928 Within HostnameError

Multiple security vulnerabilities affect the openbao-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-NZ19387 Within HostnameError

Multiple security vulnerabilities affect the openbao-fips package. Within HostnameError. See references for individual vulnerability details...

[SECURITY] Fedora 41 Update: openbao-2.4.4-1.fc41

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

[SECURITY] Fedora 42 Update: openbao-2.4.4-1.fc42

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

Fedora: Security Advisory (FEDORA-2025-6b2336ec55)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : openbao (2025-45a7dd8f10)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-45a7dd8f10 advisory. update to upstream 2.4.4, which fixed CVE-2025-64761 ---- Adds hsm tag. The fedora-41 build was done with golang-1.24.10 which fixed CVE-2025-58189,...

ROS-20251128-02

A vulnerability in OpenBao's secret management and encryption system is related to the fact that OpenBao's audit logs incorrectly edited fields when the corresponding subsystems sent byte response parameters rather than strings. strings. Exploitation of the vulnerability could allow an attacker...