OpenBao, an open source identity-based secrets management system, failed to properly quote schema names when revoking privileges in its PostgreSQL database secrets engine before version 2.5.3. This flaw allows crafted schema names to bypass normal quoting mechanisms, potentially resulting in role revocation failures or, in less common cases, SQL injection executed with the privileges of the OpenBao management user. The injection could compromise confidentiality, integrity, or availability of the database data.

Vulnerable installations of OpenBao up to and including version 2.5.2. The issue is specific to deployments that employ the PostgreSQL database secrets engine for role management.

The CVSS score of 4.6 indicates moderate severity, and the EPSS score is unavailable, suggesting no readily available data on exploitation likelihood. Because the vulnerability requires exploitation of the OpenBao API or management path, it is likely to be an internal or authenticated vector rather than a fully remote public one. The vulnerability is not listed in CISA’s KEV catalog, which reduces the urgency of immediate action but still warrants remediation due to the potential for privilege escalation.