OpenBao allows SQL Injection in PostgreSQL database secrets engine

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-39946 · CVE overview and exploitation status

EUVD-2026-24035

GHSA-6vgr-cp5c-ffx3

BIT-openbao-2026-39946

GO-2026-5192

cve-program · CVE-2026-39946

• https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3

euvd · EUVD-2026-24035

• https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3

nvd · CVE-2026-39946

• https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3

osv · GHSA-6vgr-cp5c-ffx3

• https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3
• https://nvd.nist.gov/vuln/detail/CVE-2026-39946
• https://github.com/openbao/openbao/pull/2931
• https://github.com/openbao/openbao/commit/80693a46ebb4fc2455f1c51ed1dd853b28c2fd77
• https://github.com/openbao/openbao
• https://github.com/openbao/openbao/releases/tag/v2.5.3

osv · GO-2026-5192

• https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3
• https://nvd.nist.gov/vuln/detail/CVE-2026-39946
• https://github.com/openbao/openbao/commit/80693a46ebb4fc2455f1c51ed1dd853b28c2fd77
• https://github.com/openbao/openbao/pull/2931
• https://github.com/openbao/openbao/releases/tag/v2.5.3

• OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names p… · Advisory content revised · 15 Nov 2026