CVE-2026-63132: Go/github.com/openbao/openbao vulnerability

Q: Which deployments are exposed to this issue?

Only OpenBao instances running in the highly privileged recovery mode are identified as vulnerable. The issue concerns the single recovery token used in that mode.

Q: What would an attacker gain by exploiting the timing attack?

An attacker could extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modifying data.

Q: What version fixes the issue?

OpenBao v2.6.0 includes the patch.

Published Sep 22, 2026

Updated

Impact

When running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of data.

Patches

This has been patched in OpenBao v2.6.0.

Affected Software

2 affected componentsFixes available

go/github.com/openbao/openbao>=0.1.0<=1.1.5

go/github.com/openbao/openbao<0.0.0-20260713141742-763625a20721

0.0.0-20260713141742-763625a20721

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/openbao/openbao to a version that resolves this vulnerability.
Fixed in 0.0.0-20260713141742-763625a20721
Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.6.0

Event History

Sep 22, 2026

Advisory Published

via GitHub·08:36 PM

Data Sourced

via GitHub·08:36 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Only OpenBao instances running in the highly privileged recovery mode are identified as vulnerable. The issue concerns the single recovery token used in that mode.

What would an attacker gain by exploiting the timing attack?