CVE-2026-63132
Severity not reportedOpenBao is an open source identity-based secrets management system.
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203 security-advisories@github.com
- https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8 security-advisories@github.com
- https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a security-advisories@github.com
- https://github.com/openbao/openbao/pull/3388 security-advisories@github.com
- https://github.com/openbao/openbao/pull/3472 security-advisories@github.com
- https://github.com/openbao/openbao/releases/tag/v2.6.0 security-advisories@github.com
- https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53 security-advisories@github.com