GitHub Advisoryadvisory · Go
GHSA-6vgr-cp5c-ffx3 OpenBao's SQL Injection in PostgreSQL database secrets engine
MEDIUM
Official page ↗
- Aliases
- CVE-2026-39946
- Ecosystem
- Go
- Packages
- github.com/openbao/openbao
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-89
- Reviewed
- 2026-04-21
Affected packages
• Go github.com/openbao/openbao: < 0.0.0-20260420155735-b596b0882620 → fixed in 0.0.0-20260420155735-b596b0882620
Description
Impact
When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user.
This vulnerability was originally from HashiCorp Vault.
Patches
This was addressed in v2.5.3.
Workarounds
Audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Related
Alias · CVE (1)
- CVE-2026-39946 OpenBao is an open source identity-based secrets management system. vulnerability
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-39946 advisory
- https://github.com/openbao/openbao/pull/2931 web
- https://github.com/openbao/openbao/commit/80693a46ebb4fc2455f1c51ed1dd853b28c2fd77 web
- https://github.com/openbao/openbao package
- https://github.com/openbao/openbao/releases/tag/v2.5.3 web