OpenBao allows SQL Injection in PostgreSQL database secrets engine
cve-program · CVE-2026-39946
PublishedOpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Read the publisher's advisoryeuvd · EUVD-2026-24035
PublishedOpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Read the publisher's advisorynvd · CVE-2026-39946
PublishedOpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Read the publisher's advisoryosv · GHSA-6vgr-cp5c-ffx3
Published### Impact When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was originally from HashiCorp Vault. ### Patches This was addressed in v2.5.3. ### Workarounds Audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Read the publisher's advisoryosv · GO-2026-5192
PublishedOpenBao's SQL Injection in PostgreSQL database secrets engine in github.com/openbao/openbao
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-39946 · CVE overview and exploitation status
cve-program · CVE-2026-39946
euvd · EUVD-2026-24035
nvd · CVE-2026-39946
osv · GHSA-6vgr-cp5c-ffx3
- https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3
- https://nvd.nist.gov/vuln/detail/CVE-2026-39946
- https://github.com/openbao/openbao/pull/2931
- https://github.com/openbao/openbao/commit/80693a46ebb4fc2455f1c51ed1dd853b28c2fd77
- https://github.com/openbao/openbao
- https://github.com/openbao/openbao/releases/tag/v2.5.3
osv · GO-2026-5192
- https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3
- https://nvd.nist.gov/vuln/detail/CVE-2026-39946
- https://github.com/openbao/openbao/commit/80693a46ebb4fc2455f1c51ed1dd853b28c2fd77
- https://github.com/openbao/openbao/pull/2931
- https://github.com/openbao/openbao/releases/tag/v2.5.3