CVE-2026-39946
Description
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openbao/openbaoGo | < 0.0.0-20260420155735-b596b0882620 | 0.0.0-20260420155735-b596b0882620 |
Affected products
1Patches
180693a46ebb4Correctly quote schema name in PostgreSQL revoke (#2931) (#2938)
2 files changed · +4 −1
changelog/2931.txt+3 −0 added@@ -0,0 +1,3 @@ +```release-note:security +database/postgresql: Correctly quote schema name in revoke statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. +```
plugins/database/postgresql/postgresql.go+1 −1 modified@@ -445,7 +445,7 @@ func (p *PostgreSQL) defaultDeleteUser(ctx context.Context, username string) err } revocationStmts = append(revocationStmts, fmt.Sprintf( `REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %s FROM %s;`, - (schema), + dbutil.QuoteIdentifier(schema), dbutil.QuoteIdentifier(username))) revocationStmts = append(revocationStmts, fmt.Sprintf(
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-6vgr-cp5c-ffx3ghsaADVISORY
- github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-39946ghsaADVISORY
- github.com/openbao/openbao/commit/80693a46ebb4fc2455f1c51ed1dd853b28c2fd77ghsaWEB
- github.com/openbao/openbao/pull/2931ghsaWEB
- github.com/openbao/openbao/releases/tag/v2.5.3ghsaWEB
News mentions
0No linked articles in our index yet.