Skip to content
OpenAdvisories
Medium WID-SEC-2026-1189 4 CVEs

OpenBao: Mehrere Schwachstellen

Published Apr 20, 2026 · Updated Apr 21, 2026 · Revision 2 · de-DE

Vendor: Fedora Product: Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um einen SQL-Injection Angriff durchzuführen.

Product

OpenBao ist eine Open-Source-Lösung für Secrets Management, die sensible Daten wie Passwörter, API-Schlüssel und Zertifikate sicher speichert und verwaltet.

Vulnerabilities 4

  • Medium 4.6
    CVE-2026-39946

    OpenBao allows SQL Injection in PostgreSQL database secrets engine

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreS…

    openbao openbao openbao github.com/openbao/openbao Alpine Wolfi Go
  • Low 3.1
    CVE-2026-39396

    OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no …

    openbao openbao openbao github.com/openbao/openbao Alpine Wolfi Go
  • Low 2.0
    CVE-2026-39388

    OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mT…

    openbao openbao openbao github.com/openbao/openbao Alpine Wolfi Go
  • Low 2.0
    CVE-2026-40264

    OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

    OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in anoth…

    openbao openbao openbao github.com/openbao/openbao Alpine Wolfi Go

Revision history

  1. #2

    Neue Updates von Fedora aufgenommen

  2. #1

    Initiale Fassung

References