OpenBaoGHSA-6vgr-cp5c-ffx3
OpenBao's SQL Injection in PostgreSQL database secrets engine
Medium4.9CVE-2026-39946 · Published Apr 21, 2026 · updated Sep 10, 2026
### Impact When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was originally from HashiCorp Vault. ### Patches This was addressed in v2.5.3. ### Workarounds Audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | < 0.0.0-20260420155735-b596b0882620 | 0.0.0-20260420155735-b596b0882620 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- BIT-openbao-2026-39946, CVE-2026-39946, GO-2026-5192
More OpenBao advisories
All OpenBao| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 5 | OpenBao's Namespace Deletion May Not Delete Data Properly LowMay 5 | Low | 0.0.0-20260420173541-6d2e0506e2b4 |
| Apr 21 | OpenBao's Token Store Allows Cross-Namespace Renewal, RevocationLowApr 21 | Low | 0.0.0-20260420162526-f58111d2ca54 |
| Apr 21 | OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)Low3.1Apr 21 | Low3.1 | 0.0.0-20260420180337-2b2a901aa9f7 |
| Apr 21 | OpenBao's Certificate Authentication Allows Token Renewal With Different CertificateLow3.1Apr 21 | Low3.1 | 0.0.0-20260420160924-abe84e1af4c3 |
| Mar 26 | OpenBao has Reflected XSS in its OIDC authentication error messageCriticalMar 26 | Critical | 0.0.0-20260325133417-6e2b2dd84f0e |
| Mar 26 | OpenBao lacks user confirmation for OIDC direct callback modeCritical9.6Mar 26 | Critical9.6 | 0.0.0-20260325142553-e32103951925 |