OpenBao allows SQL Injection in PostgreSQL database secrets engine (CVE-2026-39946)
Description
OpenBao versions prior to 2.5.3 contain a vulnerability in the PostgreSQL database secrets engine where improper quoting of schema names during role privilege revocation can lead to SQL injection. This flaw may cause role revocation failures or, in rare cases, allow SQL injection as the management user. The vulnerability originates from HashiCorp Vault and is fixed in OpenBao version 2.5.3. A recommended workaround is to audit database schemas and restrict users from creating new schemas or granting privileges on them.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenBao, an open source identity-based secrets management system, has a SQL injection vulnerability (CVE-2026-39946) in its PostgreSQL database secrets engine prior to version 2.5.3. The issue arises because OpenBao fails to properly quote schema names when revoking privileges on roles, potentially allowing SQL injection attacks executed with management user privileges. This vulnerability was originally identified in HashiCorp Vault and has been addressed in OpenBao version 2.5.3.
Potential Impact
The vulnerability can cause failures in revoking roles and, more critically, may allow an attacker to perform SQL injection with management user privileges in the PostgreSQL database secrets engine. This could lead to unauthorized database operations or privilege escalations within the affected system. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in OpenBao version 2.5.3. Users should upgrade to this version to remediate the vulnerability. As a temporary workaround, audit the database schemas to ensure that database users cannot create new schemas or grant privileges on them, reducing the risk of exploitation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-openbao-2026-39946
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-39946"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6aa005f4acd9273b49ab638f
Added to database: 09/08/2026, 12:56:20 UTC
Last enriched: 09/08/2026, 13:31:21 UTC
Last updated: 10/23/2026, 01:15:23 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.