PT-2026-33884 · Openbao+1 · Openbao+1

CVE-2026-39946 · Published 2026-04-20 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.5.3

Description OpenBao is an open source identity-based secrets management system. In the PostgreSQL database secrets engine, the system fails to use proper database quoting on schema names provided by PostgreSQL when revoking privileges on a role. This flaw can result in role revocation failures or, in rare cases, SQL injection as the management user.

Recommendations Update to version 2.5.3. Audit table schemas and ensure database users cannot create new schemas or grant privileges on them.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-08724

BIT-OPENBAO-2026-39946

CVE-2026-39946

GHSA-6VGR-CP5C-FFX3

GO-2026-5192

OPENSUSE-SU-2026:10594-1

OPENSUSE-SU-2026:21483-1

Affected Products

Openbao

Red Os

References · 1755

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39946.json · Exploit
• https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10594-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39946 · Security Note
• https://osv.dev/vulnerability/BIT-openbao-2026-39946 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-39946 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5192 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6vgr-cp5c-ffx3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-08724 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/openbao/openbao/releases/tag/v2.5.3 · Note
• https://github.com/openbao/openbao · Note
• https://github.com/openbao/openbao/commit/80693a46ebb4fc2455f1c51ed1dd853b28c2fd77 · Note
• https://github.com/openbao/openbao/pull/2931 · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note