Critical severityNVD Advisory· Published Sep 23, 2026· Updated Sep 29, 2026
CVE-2026-63132
CVE-2026-63132
Description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openbao/openbaoGo | < 0.0.0-20260713141742-763625a20721 | 0.0.0-20260713141742-763625a20721 |
github.com/openbao/openbaoGo | >= 0.1.0, <= 1.1.5 | — |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-34fc-gh42-pj53ghsaADVISORY
- github.com/hashicorp/vault/blob/main/CHANGELOG.mdnvdWEB
- github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8nvdWEB
- github.com/openbao/openbao/pull/3388nvdWEB
- github.com/openbao/openbao/pull/3472nvdWEB
- github.com/openbao/openbao/releases/tag/v2.6.0nvdWEB
- github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53nvdWEB
- github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287anvd
News mentions
0No linked articles in our index yet.