CVE-2026-63132

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.0

Description OpenBao is an identity-based secrets management system. The handleLogicalRecovery function in the http/logical.go file uses ordinary string equality to compare the highly privileged recovery token. A remote unauthenticated attacker can perform a timing attack—a method of inferring secret data by measuring the time a system takes to respond to different inputs—by making repeated recovery mode requests. This allows the attacker to infer the recovery token and authorize operations to read or modify data within the system.

Recommendations Update to version 2.6.0.