OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bb074cb239 advisory.

    Update to upstream 2.5.2, including fixes for CVE-2026-33757 and CVE-2026-33758


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fba501f889 advisory.

    Update to upstream 2.5.2, including fixes for CVE-2026-33757 and CVE-2026-33758


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a9c2a486a6 advisory.

    Update to upstream 2.5.2, including fixes for CVE-2026-33757 and CVE-2026-33758


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
310896	Fedora 44 : openbao (2026-bb074cb239)	Nessus	Fedora Local Security Checks	critical
304935	Fedora 42 : openbao (2026-fba501f889)	Nessus	Fedora Local Security Checks	critical
304849	Fedora 43 : openbao (2026-a9c2a486a6)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2026-33758

critical

Tenable Plugins

critical

critical

critical