NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Go

CVE-2026-63132: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

criticalCVSS 4.0 9.1GHSA-34fc-gh42-pj53

Impact When running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of data. Patches This has been patched in OpenBao v2.6.0.

Published Sep 22, 2026

Affected packages

github.com/openbao/openbao

Ecosystem
Go
Affected
< 0.0.0-20260713141742-763625a20721
Fixed in
0.0.0-20260713141742-763625a20721
Check
go list -m github.com/openbao/openbao

github.com/openbao/openbao

Ecosystem
Go
Affected
>= 0.1.0, <= 1.1.5
Fixed in
No patched version yet
Check
go list -m github.com/openbao/openbao

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

When running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of data.

Patches

This has been patched in OpenBao v2.6.0.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries