Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-39946OpenBao allows SQL Injection in PostgreSQL database secrets engine

Medium 4.6

In plain English

A medium-severity SQL injection in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)4.6Medium

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.23	openbao	2.5.4-r0	ALPINE-CVE-2026-39946
Alpine:v3.24	openbao	2.5.4-r0	ALPINE-CVE-2026-39946
Go	github.com/openbao/openbao	0.0.0-20260420155735-b596b0882620	GHSA-6vgr-cp5c-ffx3
Go	github.com/openbao/openbao	0.0.0-20260420155735-b596b0882620	GO-2026-5192

Affected products (as reported)

Vendor	Product	Versions
openbao	openbao	< 2.5.3

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

References

https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3 x_refsource_CONFIRM