CVE
CVE-2026-63132
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
Impact
When running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of data.
Patches
This has been patched in OpenBao v2.6.0.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.2
-
4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
C
H
U
0
-
C
H
U
-
Related Resources
No items found.
References
https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53, https://github.com/openbao/openbao/pull/3388, https://github.com/openbao/openbao/pull/3472, https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8, https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203, https://github.com/openbao/openbao, https://github.com/openbao/openbao/releases/tag/v2.6.0