CVE-2026-39946: 
NixOS vulnerability analysis and mitigation

CVE-2026-39946 is a SQL injection vulnerability in OpenBao's PostgreSQL database secrets engine, caused by improper quoting of schema names during role privilege revocation. It affects all OpenBao versions prior to 2.5.3 (Go module github.com/openbao/openbao). The vulnerability was originally present in HashiCorp Vault and inherited by the OpenBao fork. It was published on April 21, 2026, with a fix released in v2.5.3. The CVSS v3.1 base score is 4.9 (Medium), and the CVSS v4.0 base score is 4.6 (Medium) (Github Advisory, Red Hat Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically the failure to apply proper PostgreSQL identifier quoting to schema names when constructing SQL statements for role privilege revocation in the database secrets engine. When OpenBao builds the SQL command to revoke privileges, schema names sourced from PostgreSQL are interpolated without sanitization, allowing specially crafted schema names to break out of the intended SQL context. Exploitation requires the attacker to have high privileges within OpenBao and the ability to influence schema names — for example, by creating a PostgreSQL schema with a name containing SQL metacharacters. The more common outcome is role revocation failure; SQL injection as the management user is described as a rarer but more severe consequence (Github Advisory, Github Advisory).

Successful exploitation can result in two distinct outcomes: at minimum, role revocation operations silently fail, leaving stale database credentials active and creating unauthorized access pathways; in more severe cases, an attacker can execute arbitrary SQL commands as the PostgreSQL management user, potentially leading to unauthorized data access and exfiltration from the managed database. The confidentiality impact is high on subsequent systems (the PostgreSQL database), while integrity and availability of the vulnerable OpenBao system itself are not directly affected. There is no direct availability or integrity impact on the OpenBao instance, but persistent stale credentials could enable lateral movement within the database environment (Github Advisory, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.032% (10th percentile), indicating a low near-term exploitation probability. Exploitation requires high privileges within OpenBao and specific deployment conditions (attacker-controlled schema names in PostgreSQL), further limiting practical exploitability (Github Advisory, Red Hat Advisory).

1. Gain high-privileged access: Obtain OpenBao management credentials with sufficient privileges to interact with the PostgreSQL database secrets engine (e.g., via a compromised admin token).
2. Create a malicious schema: In the target PostgreSQL database, create a schema with a name containing SQL metacharacters or injection payloads (e.g., legit'; DROP TABLE secrets;--) using a database user that has schema creation rights.
3. Grant privileges on the malicious schema: Grant privileges on the crafted schema to a role managed by OpenBao's PostgreSQL secrets engine, so that the schema name appears in OpenBao's revocation workflow.
4. Trigger role revocation: Cause OpenBao to revoke privileges for the affected role (e.g., by revoking a lease or rotating credentials), which triggers the vulnerable SQL construction path.
5. Achieve SQL injection: The unquoted schema name is interpolated into the SQL REVOKE statement executed by the management user, causing the injected SQL to execute with management-level database privileges, potentially enabling data exfiltration or further database manipulation (Github Advisory).

• Logs: OpenBao audit logs showing role revocation errors or unexpected SQL errors from the PostgreSQL secrets engine; PostgreSQL server logs (pg_log) containing malformed or unexpected REVOKE statements with unusual schema names.
• Database: Presence of PostgreSQL schemas with names containing SQL special characters (e.g., quotes, semicolons, comment sequences); unexpected queries executed by the OpenBao management database user beyond normal credential lifecycle operations.
• Access Patterns: Stale or non-revoked database credentials remaining active after expected lease expiration; repeated failed revocation attempts logged in OpenBao for specific roles.

Upgrade OpenBao to version 2.5.3 or later, which implements proper PostgreSQL identifier quoting for schema names in the privilege revocation path (Github Advisory). As an interim workaround, audit all PostgreSQL schemas managed by OpenBao and restrict database user permissions so that no user can create new schemas or grant privileges on them — this eliminates the attacker's ability to introduce malicious schema names into the revocation workflow (Red Hat Advisory). Organizations should also review existing schemas for names containing SQL metacharacters as a precautionary measure.

The advisory was published by cipherboy on the OpenBao GitHub repository and credited reporter jmecom for discovery. Red Hat tracked the issue via Bugzilla (Bug 2459953) with medium priority and severity. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time (Github Advisory, Red Hat Bugzilla).