Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 631
Alerts This Week
Warning Icon 1 631

Fedora 44 Openbao Critical XSS Fixes for CVE-2026-33757 CVE-2026-33758

fedora
Calendar Grey April 25, 2026
Dist Fedora Esm H88
Update on Fedora 44 Openbao version 2.5.2 fixes critical security issues including XSS vulnerabilities and more.
Update to upstream 2.5.2, including fixes for CVE-2026-33757 and CVE-2026-33758

Summary

Openbao secures, stores, and tightly controls access to tokens, passwords,

certificates, API keys, and other secrets in modern computing. Openbao handles

leasing, key revocation, key rolling, and auditing. Through a unified API, users

can access an encrypted Key/Value store and network encryption-as-a-service, or

generate AWS IAM/STS credentials, SQL/NoSQL databases, X.509 certificates, SSH

credentials, and more.

Update Information:

Update to upstream 2.5.2, including fixes for CVE-2026-33757 and CVE-2026-33758

Topics%20covered

Topics Covered

security advisory security issue fedora critical XSS openbao

Change Log

* Wed Mar 25 2026 Dave Dykstra <2129743+DrDaveD@users.noreply.github.com> - 2.5.2-1 - update to upstream 2.5.2

References


[ 1 ] Bug #2452352 - CVE-2026-33757 openbao: lack of user confirmation for OpenBao OIDC direct callback mode [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2452352 [ 2 ] Bug #2452355 - CVE-2026-33758 openbao: reflected XSS in OpenBao OIDC authentication error message [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2452355

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-bb074cb239' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: openbao
Product: Fedora 44
Version: 2.5.2
Release: 1.fc44
URL: https://openbao.org
Summary: A tool for securely accessing secrets

Topics%20covered

Topics Covered

security advisory security issue fedora critical XSS openbao

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.