OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does
    not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to
    `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by
    having the victim visit the URL and automatically log-in to the session of the attacker. Despite being
    based on the authorization code flow, the `direct` mode calls back directly to the API and allows an
    attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional
    confirmation screen for `direct` type logins that requires manual user interaction in order to finish the
    authentication. This issue can be worked around either by removing any roles with `callback_mode=direct`
    or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.
    (CVE-2026-33757)

  - An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete
    secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did
    not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault
    Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16. (CVE-2026-3605)

  - Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly
    initiate or cancel root token generation or rekey operations, occupying the single in-progress operation
    slot. This prevents legitimate operators from completing these workflows. This vulnerability,
    CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0. (CVE-2026-5807)

  - OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao
    installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct`
    configured are vulnerable to XSS via the `error_description` parameter on the page for a failed
    authentication. This allows an attacker access to the token used in the Web UI by a victim. The
    `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability
    can be mitigated by removing any roles with `callback_mode` set to `direct`. (CVE-2026-33758)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao
    revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper
    database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or
    more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault.
    The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users
    cannot create new schemas and grant privileges on them. (CVE-2026-39946)

ID	Name	Product	Family	Severity
442269	Alpine: multiple openbao packages: security update to 2.5.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
442269	Alpine: multiple openbao packages: security update to 2.5.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
440687	SCA: security update for github.com/openbao/openbao (GHSA-6vgr-cp5c-ffx3)	Tenable Cloud Security	SCA Checks	medium
440687	SCA: security update for github.com/openbao/openbao (GHSA-6vgr-cp5c-ffx3)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-39946

medium

Tenable Plugins

critical

critical

medium

medium