CVE-2026-63132CWE-208

CVE-2026-63132

published September 23, 2026

CVSS
9.2
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-208 · Observable Timing Discrepancy
Published
2026-09-23T23:17Z
References (7)
https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203 · [email protected]https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8 · [email protected]https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a · [email protected]https://github.com/openbao/openbao/pull/3388 · [email protected]https://github.com/openbao/openbao/pull/3472 · [email protected]https://github.com/openbao/openbao/releases/tag/v2.6.0 · [email protected]https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53 · [email protected]
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 23 SEP 17:59Z
    OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
    cvelistv5