Live › vulnerability › CVE-2026-63132
Go to dashboardOpenBao's recovery mode endpoint compares the recovery token with ordinary string equality, which leaks timing information. A remote unauthenticated attacker who measures response times can recover the recovery token and then read or modify OpenBao data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/openbao/openbao | go | >= 0.1.0, < 0.0.0-20260713141742-763625a20721 | 0.0.0-20260713141742-763625a20721 |
Check the OpenBao version with the bao version command or the go.mod entry for github.com/openbao/openbao; versions before 2.6.0 (or pseudo-version before 0.0.0-20260713141742-763625a20721) are affected.
2.6.0 or later (pseudo-version 0.0.0-20260713141742-763625a20721)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-63132")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.