113 matches found
BIT-OPENBAO-2026-55776 OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/ could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy...
GHSA-59W7-V8RR-PR4P OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
Impact ACL Policies OpenBao supports "templated polices": Policies with placeholders that are replaced at evaluation time. This allows you to write a single policy which e.g. grants user "alice" access to all entries in a key value engine prefixed with alice/ while granting "bob" access to bob/,...
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
Impact ACL Policies OpenBao supports "templated polices": Policies with placeholders that are replaced at evaluation time. This allows you to write a single policy which e.g. grants user "alice" access to all entries in a key value engine prefixed with alice/ while granting "bob" access to bob/,...
CLEANSTART-2026-RG79000 Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period
Security vulnerability affects the vault package. Vault and Vault Enterprise’s “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period...
CVE-2026-55776 OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/ could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy...
BIT-OPENBAO-2026-39946 OpenBao allows SQL Injection in PostgreSQL database secrets engine
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...
BIT-OPENBAO-2024-7594 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default
Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...
PT-2026-65036
Vault’s SSH secrets engine did not require the valid principals list to contain a value by default. If the valid principals and default user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used t...
GO-2026-5192 OpenBao's SQL Injection in PostgreSQL database secrets engine in github.com/openbao/openbao
OpenBao's SQL Injection in PostgreSQL database secrets engine in github.com/openbao/openbao...
SUSE CVE-2025-6014
Vault and Vault Enterprise's “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...
OpenBao's SQL Injection in PostgreSQL database secrets engine
Impact When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability w...
GHSA-6VGR-CP5C-FFX3 OpenBao's SQL Injection in PostgreSQL database secrets engine
Impact When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability w...
CVE-2026-39946
A flaw was found in OpenBao. When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, it failed to use proper database quoting on schema names. This oversight could lead to role revocation failures or, in rarer instances, allow a management user to perform SQL injectio...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection due to improper quoting of schema names in the PostgreSQL database secrets engine during the role revocation process. An attacker can execute arbitrary SQL commands as the management user by supplying crafted schema names...
CVE-2026-39946 OpenBao allows SQL Injection in PostgreSQL database secrets engine
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...
CVE-2026-39946
OpenBao (open source identity-based secrets manager) before version 2.5.3 is affected. When revoking privileges on a role within the PostgreSQL database secrets engine, OpenBao could fail to properly quote schema names provided by PostgreSQL, potentially leading to role revocation failures and, m...
CVE-2026-39946 OpenBao allows SQL Injection in PostgreSQL database secrets engine
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...
CVE-2026-39946: Improper Neutralization of Special Elements used in an SQL Command
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...
