PT-2026-33884 · Openbao+1 · Openbao+1

Published 2026-04-21 · Updated 2026-05-27 · CVE-2026-39946

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.3

Description OpenBao is an open source identity-based secrets management system. In the PostgreSQL database secrets engine, the system fails to use proper database quoting on schema names provided by PostgreSQL when revoking privileges on a role. This flaw can result in role revocation failures or, in rare cases, SQL injection as the management user.

Recommendations Update to version 2.5.3. Audit table schemas and ensure database users cannot create new schemas or grant privileges on them.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39946

GHSA-6VGR-CP5C-FFX3

OPENSUSE-SU-2026:10594-1

Affected Products

Openbao

Red Os

References · 19

• https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39946 · Security Note
• https://osv.dev/vulnerability/GHSA-6vgr-cp5c-ffx3 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10594-1 · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://github.com/openbao/openbao/releases/tag/v2.5.3 · Note
• https://github.com/openbao/openbao/commit/80693a46ebb4fc2455f1c51ed1dd853b28c2fd77 · Note
• https://github.com/openbao/openbao/pull/2931 · Note
• https://suse.com/security/cve/CVE-2026-3605 · Note
• https://suse.com/security/cve/CVE-2026-39396 · Note
• https://suse.com/security/cve/CVE-2026-39946 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-openbao-cve-2026-39946-8.0 · Note
• https://suse.com/security/cve/CVE-2026-39388 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-openbao-cve-2026-39946-7.3 · Note
• https://suse.com/security/cve/CVE-2026-5807 · Note