CVE-2026-63132
Received Received - Intake

Timing Attack in OpenBao Recovery Token

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-63132
EUVD
EUVD-2026-85520

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openbao openbao 2.6.0
openbao openbao to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenBao (CVE-2026-63132) involves a timing attack due to insecure recovery token comparison. Prior to version 2.6.0, OpenBao compared highly privileged recovery tokens using standard string equality, which is vulnerable to timing attacks. An attacker could exploit response time variations to infer the recovery token and then use it to perform unauthorized recovery mode operations that read or modify OpenBao data.

Detection Guidance

Detecting this vulnerability requires checking if your OpenBao instance is running a version prior to 2.6.0. Use the command: openbao version. If the version is below 2.6.0, the system is vulnerable. Additionally, monitor network traffic for repeated recovery mode requests that may indicate timing attack attempts.

Impact Analysis

If exploited, this vulnerability allows remote unauthenticated attackers to gain unauthorized access to OpenBao's recovery mode. They could then read sensitive data, modify configurations, or perform other privileged operations. The attack requires network access but no privileges or user interaction, making it particularly dangerous for systems running vulnerable versions.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using vulnerable OpenBao versions may face compliance violations, data breaches, and potential regulatory penalties due to insufficient protection of personal or health information.

Mitigation Strategies

Upgrade OpenBao to version 2.6.0 or later immediately. This version includes the fix for the timing attack vulnerability in recovery token comparison. After upgrading, verify the fix by checking the version and reviewing logs for any unusual recovery mode activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63132. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart