OPENSUSE-SU-2026:10594-1

Vulnerability from csaf_opensuse - Published: 2026-04-21 00:00 - Updated: 2026-04-21 00:00
Summary
openbao-2.5.3-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: openbao-2.5.3-1.1 on GA media
Description of the patch: These are all security issues fixed in the openbao-2.5.3-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-10594
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-3605
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-39388
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-39396
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-39946
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-40264
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-5807
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "openbao-2.5.3-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the openbao-2.5.3-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10594",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10594-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-3605 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-3605/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39388 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39388/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39396 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39396/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39946 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39946/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-40264 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-40264/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-5807 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-5807/"
      }
    ],
    "title": "openbao-2.5.3-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-04-21T00:00:00Z",
      "generator": {
        "date": "2026-04-21T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10594-1",
      "initial_release_date": "2026-04-21T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-21T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openbao-2.5.3-1.1.aarch64",
                "product": {
                  "name": "openbao-2.5.3-1.1.aarch64",
                  "product_id": "openbao-2.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-agent-2.5.3-1.1.aarch64",
                "product": {
                  "name": "openbao-agent-2.5.3-1.1.aarch64",
                  "product_id": "openbao-agent-2.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
                "product": {
                  "name": "openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
                  "product_id": "openbao-cassandra-database-plugin-2.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
                "product": {
                  "name": "openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
                  "product_id": "openbao-influxdb-database-plugin-2.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
                "product": {
                  "name": "openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
                  "product_id": "openbao-mysql-database-plugin-2.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
                "product": {
                  "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
                  "product_id": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
                "product": {
                  "name": "openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
                  "product_id": "openbao-postgresql-database-plugin-2.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-server-2.5.3-1.1.aarch64",
                "product": {
                  "name": "openbao-server-2.5.3-1.1.aarch64",
                  "product_id": "openbao-server-2.5.3-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openbao-2.5.3-1.1.ppc64le",
                "product": {
                  "name": "openbao-2.5.3-1.1.ppc64le",
                  "product_id": "openbao-2.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-agent-2.5.3-1.1.ppc64le",
                "product": {
                  "name": "openbao-agent-2.5.3-1.1.ppc64le",
                  "product_id": "openbao-agent-2.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
                "product": {
                  "name": "openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
                  "product_id": "openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
                "product": {
                  "name": "openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
                  "product_id": "openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
                "product": {
                  "name": "openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
                  "product_id": "openbao-mysql-database-plugin-2.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
                "product": {
                  "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
                  "product_id": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
                "product": {
                  "name": "openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
                  "product_id": "openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-server-2.5.3-1.1.ppc64le",
                "product": {
                  "name": "openbao-server-2.5.3-1.1.ppc64le",
                  "product_id": "openbao-server-2.5.3-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openbao-2.5.3-1.1.s390x",
                "product": {
                  "name": "openbao-2.5.3-1.1.s390x",
                  "product_id": "openbao-2.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-agent-2.5.3-1.1.s390x",
                "product": {
                  "name": "openbao-agent-2.5.3-1.1.s390x",
                  "product_id": "openbao-agent-2.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
                "product": {
                  "name": "openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
                  "product_id": "openbao-cassandra-database-plugin-2.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
                "product": {
                  "name": "openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
                  "product_id": "openbao-influxdb-database-plugin-2.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-mysql-database-plugin-2.5.3-1.1.s390x",
                "product": {
                  "name": "openbao-mysql-database-plugin-2.5.3-1.1.s390x",
                  "product_id": "openbao-mysql-database-plugin-2.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
                "product": {
                  "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
                  "product_id": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
                "product": {
                  "name": "openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
                  "product_id": "openbao-postgresql-database-plugin-2.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-server-2.5.3-1.1.s390x",
                "product": {
                  "name": "openbao-server-2.5.3-1.1.s390x",
                  "product_id": "openbao-server-2.5.3-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openbao-2.5.3-1.1.x86_64",
                "product": {
                  "name": "openbao-2.5.3-1.1.x86_64",
                  "product_id": "openbao-2.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-agent-2.5.3-1.1.x86_64",
                "product": {
                  "name": "openbao-agent-2.5.3-1.1.x86_64",
                  "product_id": "openbao-agent-2.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
                "product": {
                  "name": "openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
                  "product_id": "openbao-cassandra-database-plugin-2.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
                "product": {
                  "name": "openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
                  "product_id": "openbao-influxdb-database-plugin-2.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
                "product": {
                  "name": "openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
                  "product_id": "openbao-mysql-database-plugin-2.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
                "product": {
                  "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
                  "product_id": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
                "product": {
                  "name": "openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
                  "product_id": "openbao-postgresql-database-plugin-2.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openbao-server-2.5.3-1.1.x86_64",
                "product": {
                  "name": "openbao-server-2.5.3-1.1.x86_64",
                  "product_id": "openbao-server-2.5.3-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-2.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64"
        },
        "product_reference": "openbao-2.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-2.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le"
        },
        "product_reference": "openbao-2.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-2.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x"
        },
        "product_reference": "openbao-2.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-2.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64"
        },
        "product_reference": "openbao-2.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-agent-2.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64"
        },
        "product_reference": "openbao-agent-2.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-agent-2.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le"
        },
        "product_reference": "openbao-agent-2.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-agent-2.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x"
        },
        "product_reference": "openbao-agent-2.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-agent-2.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64"
        },
        "product_reference": "openbao-agent-2.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-cassandra-database-plugin-2.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64"
        },
        "product_reference": "openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le"
        },
        "product_reference": "openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-cassandra-database-plugin-2.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x"
        },
        "product_reference": "openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-cassandra-database-plugin-2.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64"
        },
        "product_reference": "openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-influxdb-database-plugin-2.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64"
        },
        "product_reference": "openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le"
        },
        "product_reference": "openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-influxdb-database-plugin-2.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x"
        },
        "product_reference": "openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-influxdb-database-plugin-2.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64"
        },
        "product_reference": "openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-mysql-database-plugin-2.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64"
        },
        "product_reference": "openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-mysql-database-plugin-2.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le"
        },
        "product_reference": "openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-mysql-database-plugin-2.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x"
        },
        "product_reference": "openbao-mysql-database-plugin-2.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-mysql-database-plugin-2.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64"
        },
        "product_reference": "openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64"
        },
        "product_reference": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le"
        },
        "product_reference": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x"
        },
        "product_reference": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64"
        },
        "product_reference": "openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-postgresql-database-plugin-2.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64"
        },
        "product_reference": "openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le"
        },
        "product_reference": "openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-postgresql-database-plugin-2.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x"
        },
        "product_reference": "openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-postgresql-database-plugin-2.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64"
        },
        "product_reference": "openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-server-2.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64"
        },
        "product_reference": "openbao-server-2.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-server-2.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le"
        },
        "product_reference": "openbao-server-2.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-server-2.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x"
        },
        "product_reference": "openbao-server-2.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openbao-server-2.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
        },
        "product_reference": "openbao-server-2.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-3605",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-3605"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-3605",
          "url": "https://www.suse.com/security/cve/CVE-2026-3605"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-3605"
    },
    {
      "cve": "CVE-2026-39388",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39388"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao\u0027s Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request\u0027s presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39388",
          "url": "https://www.suse.com/security/cve/CVE-2026-39388"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262419 for CVE-2026-39388",
          "url": "https://bugzilla.suse.com/1262419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-39388"
    },
    {
      "cve": "CVE-2026-39396",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39396"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao\u0027s OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim\u0027s configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file. The SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature. Version 2.5.3 contains a patch.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39396",
          "url": "https://www.suse.com/security/cve/CVE-2026-39396"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262420 for CVE-2026-39396",
          "url": "https://bugzilla.suse.com/1262420"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-21T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-39396"
    },
    {
      "cve": "CVE-2026-39946",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39946"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39946",
          "url": "https://www.suse.com/security/cve/CVE-2026-39946"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262421 for CVE-2026-39946",
          "url": "https://bugzilla.suse.com/1262421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-39946"
    },
    {
      "cve": "CVE-2026-40264",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-40264"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenBao is an open source identity-based secrets management system. OpenBao\u0027s namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-40264",
          "url": "https://www.suse.com/security/cve/CVE-2026-40264"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262422 for CVE-2026-40264",
          "url": "https://bugzilla.suse.com/1262422"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-40264"
    },
    {
      "cve": "CVE-2026-5807",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-5807"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
          "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-5807",
          "url": "https://www.suse.com/security/cve/CVE-2026-5807"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-agent-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-cassandra-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-influxdb-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-mysql-legacy-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-postgresql-database-plugin-2.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.s390x",
            "openSUSE Tumbleweed:openbao-server-2.5.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-5807"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.