CVE-2026-33757: Remote Phishing in OpenBao Secrets Management

The primary impact of CVE-2026-33757 is the potential for unauthorized access to sensitive secrets managed by OpenBao. An attacker can initiate an authentication request and trick a legitimate user into visiting a malicious URL. Due to the direct callback mode, the attacker can then poll the API for an OpenBao token, effectively logging into the victim's session without requiring any credentials. This bypasses standard authentication controls and allows the attacker to access and potentially exfiltrate secrets stored within OpenBao. The blast radius extends to any application or service relying on OpenBao for secrets management, as compromised secrets could be used to gain access to other systems.

1. Reserved2026-03-23
2. Published2026-03-27
3. Modified2026-04-01
4. EPSS updated2026-04-04

The primary mitigation for CVE-2026-33757 is to immediately upgrade OpenBao to version 2.5.2 or later. This version includes a user confirmation prompt during JWT/OIDC login, effectively preventing the remote phishing attack. If upgrading is not immediately feasible, consider temporarily disabling the callback_mode: direct configuration for roles where it is enabled. While this will impact the user experience, it will significantly reduce the attack surface. Monitor OpenBao logs for suspicious login attempts and implement Web Application Firewall (WAF) rules to detect and block malicious requests targeting the authentication endpoint. There are no specific Sigma or YARA rules available at this time, but monitoring for unusual JWT/OIDC authentication patterns is recommended.