https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:58:42 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-08724 bdu:2026-08724 https://cve.radiocsirt.org/vuln/bdu:2026-08724 https://cve.radiocsirt.org/vuln/bit-openbao-2026-39946 <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.</p> <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.</p> https://cve.radiocsirt.org/vuln/bit-openbao-2026-39946 https://cve.radiocsirt.org/vuln/euvd-2026-292189 EUVD-2026-292189 https://cve.radiocsirt.org/vuln/euvd-2026-292189 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39946 <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.</p> <p>OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39946 https://cve.radiocsirt.org/vuln/ghsa-6vgr-cp5c-ffx3 <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Impact</p> <p>When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user.</p> <p>This vulnerability was originally from HashiCorp Vault.</p> <p>### Patches</p> <p>This was addressed in v2.5.3.</p> <p>### Workarounds</p> <p>Audit table schemas and ensure database users cannot create new schemas and grant privileges on them.</p> <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Impact</p> <p>When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user.</p> <p>This vulnerability was originally from HashiCorp Vault.</p> <p>### Patches</p> <p>This was addressed in v2.5.3.</p> <p>### Workarounds</p> <p>Audit table schemas and ensure database users cannot create new schemas and grant privileges on them.</p> https://cve.radiocsirt.org/vuln/ghsa-6vgr-cp5c-ffx3 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10594-1 <p>openbao-2.5.3-1.1 on GA media</p> <p>openbao-2.5.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10594-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1189 <p>Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um einen SQL-Injection Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um einen SQL-Injection Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1189