Critical severity · published Sep 23, 2026
CVE-2026-63132
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
9.2
CVSS
0.6%
EPSS
No
On KEV
Description
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openbao · openbao
< 2.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63132
github.com
https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
github.com
https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
github.com
https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a
github.com
https://github.com/openbao/openbao/pull/3388
github.com
https://github.com/openbao/openbao/pull/3472
github.com
https://github.com/openbao/openbao/releases/tag/v2.6.0
More from openbao
9.8
CVE-2024-2048
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate
9.1
CVE-2025-54997
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys
8.8
CVE-2024-7594
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default
8.3
CVE-2026-33757
OpenBao lacks user confirmation for OIDC direct callback mode
7.5
CVE-2026-71543
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters