github.com
https://github.com/openbao/openbao CVE-2026-39946
MEDIUM
OpenBao allows SQL Injection in PostgreSQL database secrets engine
Record summary
CVE-2026-39946 has a selected CVSS score of 4.6 (medium).
Description
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 21, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
openbaoBrowse openbao / openbao | CVE List | < 2.5.3 | affected |
github.com/openbao/openbaoBrowse Go / github.com/openbao/openbao | GitHub Advisory | Before 0.0.0-20260420155735-b596b0882620 · Fixed in 0.0.0-20260420155735-b596b0882620 | affected |
References
6github.com
https://github.com/openbao/openbao/commit/80693a46ebb4fc2455f1c51ed1dd853b28c2fd77 github.com
https://github.com/openbao/openbao/pull/2931 github.com
https://github.com/openbao/openbao/releases/tag/v2.5.3 github.comConfirmation
https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-39946