Advisoriesby IbisOpenBaoGHSA-6vgr-cp5c-ffx3
OpenBao's SQL Injection in PostgreSQL database secrets engine
Fix: upgrade to 0.0.0-20260420155735-b596b0882620 or later
Impact
When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user.
This vulnerability was originally from HashiCorp Vault.
Patches
This was addressed in v2.5.3.
Workarounds
Audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | < 0.0.0-20260420155735-b596b0882620 | 0.0.0-20260420155735-b596b0882620 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- BIT-openbao-2026-39946, CVE-2026-39946, GO-2026-5192
More OpenBao advisories
All OpenBao
OpenBao's Namespace Deletion May Not Delete Data ProperlyCVE-2026-42186fixed in 0.0.0-20260420173541-6d2e0506e2b4OpenBao's Token Store Allows Cross-Namespace Renewal, RevocationCVE-2026-40264fixed in 0.0.0-20260420162526-f58111d2ca54OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)CVE-2026-39396fixed in 0.0.0-20260420180337-2b2a901aa9f7OpenBao's Certificate Authentication Allows Token Renewal With Different CertificateCVE-2026-39388fixed in 0.0.0-20260420160924-abe84e1af4c3OpenBao has Reflected XSS in its OIDC authentication error messageCVE-2026-33758fixed in 0.0.0-20260325133417-6e2b2dd84f0eOpenBao lacks user confirmation for OIDC direct callback modeCVE-2026-33757fixed in 0.0.0-20260325142553-e32103951925