There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao
    installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct`
    configured are vulnerable to XSS via the `error_description` parameter on the page for a failed
    authentication. This allows an attacker access to the token used in the Web UI by a victim. The
    `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability
    can be mitigated by removing any roles with `callback_mode` set to `direct`. (CVE-2026-33758)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does
    not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to
    `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by
    having the victim visit the URL and automatically log-in to the session of the attacker. Despite being
    based on the authorization code flow, the `direct` mode calls back directly to the API and allows an
    attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional
    confirmation screen for `direct` type logins that requires manual user interaction in order to finish the
    authentication. This issue can be worked around either by removing any roles with `callback_mode=direct`
    or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.
    (CVE-2026-33757)

  - An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete
    secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did
    not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault
    Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16. (CVE-2026-3605)

  - Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly
    initiate or cancel root token generation or rekey operations, occupying the single in-progress operation
    slot. This prevents legitimate operators from completing these workflows. This vulnerability,
    CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0. (CVE-2026-5807)

  - OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao
    installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct`
    configured are vulnerable to XSS via the `error_description` parameter on the page for a failed
    authentication. This allows an attacker access to the token used in the Web UI by a victim. The
    `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability
    can be mitigated by removing any roles with `callback_mode` set to `direct`. (CVE-2026-33758)

リモートの Fedora 43 ホストには、FEDORA-2026-a9c2a486a6 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

     2.5.2CVE-2026-33757 および CVE-2026-33758[] の修正を含む、Upstream への更新


Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの Fedora 42 ホストには、FEDORA-2026-fba501f889 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

     2.5.2CVE-2026-33757 および CVE-2026-33758[] の修正を含む、Upstream への更新


Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの Fedora 44 ホストには、FEDORA-2026-bb074cb239 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    上流 2.5.2のアップデート、 CVE-2026-33757 および CVE-2026-33758


Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a9c2a486a6 advisory.

    Update to upstream 2.5.2, including fixes for CVE-2026-33757 and CVE-2026-33758


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fba501f889 advisory.

    Update to upstream 2.5.2, including fixes for CVE-2026-33757 and CVE-2026-33758


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bb074cb239 advisory.

    Update to upstream 2.5.2, including fixes for CVE-2026-33757 and CVE-2026-33758


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
439337	SCA: security update for github.com/openbao/openbao (GHSA-cpj3-3r2f-xj59)	Tenable Cloud Security	SCA Checks	2026/3/27	2026/7/2	critical
442269	Alpine: multiple openbao packages: security update to 2.5.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/5/22	2026/7/2	critical
442269	Alpine: multiple openbao packages: security update to 2.5.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/5/22	2026/7/2	critical
439337	SCA: security update for github.com/openbao/openbao (GHSA-cpj3-3r2f-xj59)	Tenable Self-Hosted Container Security	SCA Checks	2026/3/27	2026/7/2	critical
304849	Fedora 43openbao2026-a9c2a486a6	Nessus	Fedora Local Security Checks	2026/4/4	2026/4/4	critical
304935	Fedora 42openbao2026-fba501f889	Nessus	Fedora Local Security Checks	2026/4/5	2026/4/5	critical
310896	Fedora 44 : openbao (2026-bb074cb239)	Nessus	Fedora Local Security Checks	2026/4/29	2026/4/29	critical
304849	Fedora 43 : openbao (2026-a9c2a486a6)	Nessus	Fedora Local Security Checks	2026/4/4	2026/4/4	critical
304935	Fedora 42 : openbao (2026-fba501f889)	Nessus	Fedora Local Security Checks	2026/4/5	2026/4/5	critical
310896	Fedora 44 : openbao (2026-bb074cb239)	Nessus	Fedora Local Security Checks	2026/4/29	2026/4/29	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical