https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:54:51.148646+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-08724 bdu:2026-08724 2026-10-03T20:54:51.270838+00:00 bdu:2026-08724 https://cve.radiocsirt.org/vuln/bit-openbao-2026-39946 BIT-openbao-2026-39946 — OpenBao allows SQL Injection in PostgreSQL database secrets engine 2026-10-03T20:54:51.270887+00:00

Affected: Bitnami: openbao

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.

 https://cve.radiocsirt.org/vuln/euvd-2026-292189 EUVD-2026-292189 2026-10-03T20:54:51.270928+00:00 EUVD-2026-292189 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39946 fkie_cve-2026-39946 2026-10-03T20:54:51.270943+00:00

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.

 https://cve.radiocsirt.org/vuln/ghsa-6vgr-cp5c-ffx3 GHSA-6vgr-cp5c-ffx3 — OpenBao's SQL Injection in PostgreSQL database secrets engine 2026-10-03T20:54:51.270969+00:00

Affected: Go: github.com/openbao/openbao

### Impact

When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user.

This vulnerability was originally from HashiCorp Vault.

### Patches

This was addressed in v2.5.3.

### Workarounds

Audit table schemas and ensure database users cannot create new schemas and grant privileges on them.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10594-1 openSUSE-SU-2026:10594-1 — openbao-2.5.3-1.1 on GA media 2026-10-03T20:54:51.271000+00:00

openbao-2.5.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1189 WID-SEC-W-2026-1189 — OpenBao: Mehrere Schwachstellen 2026-10-03T20:54:51.271023+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um einen SQL-Injection Angriff durchzuführen.