GitHub Advisoryadvisory · Go

GHSA-34fc-gh42-pj53 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

CRITICAL Published 2026-09-22 Modified 2026-09-22 Official page ↗
Aliases
CVE-2026-63132
Ecosystem
Go
Packages
github.com/openbao/openbao
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-208
Reviewed
2026-09-22

Affected packages

• Go github.com/openbao/openbao: < 0.0.0-20260713141742-763625a20721 → fixed in 0.0.0-20260713141742-763625a20721 • Go github.com/openbao/openbao: >= 0.1.0, <= 1.1.5 (no fix yet)

Description

Impact When running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of data. Patches This has been patched in OpenBao v2.6.0.

Related

Alias · CVE (1)

  • CVE-2026-63132 OpenBao is an open source identity-based secrets management system. vulnerability

Weakness · CWE (1)

  • CWE-208 Observable Timing Discrepancy weakness

References