~ / search / GHSA-6vgr-cp5c-ffx3

GHSA-6vgr-cp5c-ffx3

OpenBao's SQL Injection in PostgreSQL database secrets engine

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-39946

Packages

EcosystemPackageAffectedFixed in
Go github.com/openbao/openbao < 0.0.0-20260420155735-b596b0882620 0.0.0-20260420155735-b596b0882620

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was originally from HashiCorp Vault. ### Patches This was addressed in v2.5.3. ### Workarounds Audit table schemas and ensure database users cannot create new schemas and grant privileges on them.

References

External links from the advisory. They lead to third-party sites.