{"id":"CVE-2026-63132","kind":"vulnerability","aliases":["CVE-2026-63132","GHSA-34fc-gh42-pj53","GO-2026-6553"],"related":[],"title":"OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao","description":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.","summary":"OpenBao's recovery mode endpoint compares the recovery token with ordinary string equality, which leaks timing information. A remote unauthenticated attacker who measures response times can recover the recovery token and then read or modify OpenBao data.","severity":"critical","cvss":9.2,"epss":0.00497,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/openbao/openbao","fixed":["0.0.0-20260713141742-763625a20721"],"affected":">= 0.1.0, < 0.0.0-20260713141742-763625a20721","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","openbao","package","secrets-management","self-hosted"],"not_affected_if":["managed-hosting","recovery-mode-disabled"],"how_to_check":"Check the OpenBao version with the bao version command or the go.mod entry for github.com/openbao/openbao; versions before 2.6.0 (or pseudo-version before 0.0.0-20260713141742-763625a20721) are affected.","fix":"Upgrade github.com/openbao/openbao to 2.6.0 or later (pseudo-version 0.0.0-20260713141742-763625a20721).\nIf you cannot upgrade, disable recovery mode or block network access to the recovery endpoints.","status":"open","published_at":"2026-09-23T19:17:34+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:43:45+00:00","updated_at":"2026-10-23T21:43:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:43:45Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/openbao/openbao to 2.6.0 or later (pseudo-version 0.0.0-20260713141742-763625a20721).\nIf you cannot upgrade, disable recovery mode or block network access to the recovery endpoints.","reach":"internet","impact":"high","summary":"OpenBao's recovery mode endpoint compares the recovery token with ordinary string equality, which leaks timing information. A remote unauthenticated attacker who measures response times can recover the recovery token and then read or modify OpenBao data.","category":"package","who_cares":["openbao","go","self-hosted","secrets-management"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker recovers recovery token and reads or modifies all OpenBao secrets","analyst_note":"Confirm whether recovery mode is enabled by default and what config disables it, using the GHSA-34fc-gh42-pj53 advisory and the NVD entry.","how_to_check":"Check the OpenBao version with the bao version command or the go.mod entry for github.com/openbao/openbao; versions before 2.6.0 (or pseudo-version before 0.0.0-20260713141742-763625a20721) are affected.\nUnknown whether recovery mode is enabled by default on your deployment; check the recovery mode configuration.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","recovery-mode-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000569,"input_tokens":3017,"output_tokens":535,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A,28A '-63132':18A,29A '-6553':26A '/openbao/openbao':15A,32A '2.6.0':92C,150C '34fc':21A 'abl':113C 'attack':11A,62B,112C 'author':134C 'base':86C 'compar':47B,99C 'could':124C,132C 'cve':16A,27A 'data':78B,143C 'endpoint':46B 'equal':54B,108C 'fix':147C 'gh42':22A 'ghsa':20A 'ghsa-34fc-gh42-pj53':19A 'github.com':14A,31A 'github.com/openbao/openbao':13A,30A 'go':24A,33B 'handlelogicalrecoveri':95C 'high':101C 'host':41B 'http/logical.go':98C 'ident':85C 'identity-bas':84C 'infer':125C 'inform':58B 'issu':145C 'leak':56B 'leakag':8A 'make':115C 'manag':38B,88C 'measur':64B,121C 'mode':4A,45B,118C,136C 'modifi':76B,141C 'open':82C 'openbao':1A,34B,42B,77B,79C,93C,142C 'oper':137C 'ordinari':52B,106C 'packag':35B 'path':96C 'pj53':23A 'prior':90C 'privileg':102C 'read':74B,139C 'recov':68B,130C 'recoveri':3A,44B,49B,70B,103C,117C,127C,135C 'remot':60B,110C 'repeat':116C 'request':119C 'respons':65B,122C 'secret':37B,87C 'secrets-manag':36B 'self':40B 'self-host':39B 'sourc':83C 'string':53B,107C 'system':89C 'time':10A,57B,66B,123C 'token':7A,50B,71B,104C,128C,131C 'unauthent':61B,111C 'version':149C 'via':9A 'vulner':5A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-23T19:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6553","url":"https://pkg.go.dev/vuln/GO-2026-6553","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-63132","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63132","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-63132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63132","severity":null,"published_at":"2026-09-23T19:17:34+00:00","modified_at":"2026-09-29T19:06:32+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}