SQL Injection in Openbao
CVE-2026-39946
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Vulnerability class: SQL Injection
EPSS: 0.002 (14.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Openbao — versions < 2.5.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-39946?
- CVE-2026-39946 is a medium-severity vulnerability in Openbao, classified under SQL Injection. CVSS score: 4.9/10. Published 2026-04-21.
- How severe is CVE-2026-39946?
- Medium severity. CVSS v3 base score is 4.9 out of 10.