cve-2026-63132

CRITICAL CVSS 9.2 cvelistv5
Description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.

Timeline
Published
2026-09-23 17:59 UTC
Last Modified
2026-09-23
CVSS Details
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
Affected Products
  • openbao openbao
Weaknesses (CWE)
CWE-208
SSVC (CISA Stakeholder-Specific Vulnerability Categorization) CISA Coordinator v2.0.3
Exploitation
none
Automatable
no
Technical Impact
total
Decision timestamp
2026-09-23T19:13:35.308605Z

What is SSVC? — CISA's vulnerability-prioritisation framework using a decision tree rather than a single score.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63132",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:13:35.308605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:16:11.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openbao",
          "vendor": "openbao",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T17:59:19.639Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53"
        },
        {
          "name": "https://github.com/openbao/openbao/pull/3388",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/pull/3388"
        },
        {
          "name": "https://github.com/openbao/openbao/pull/3472",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/pull/3472"
        },
        {
          "name": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8"
        },
        {
          "name": "https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a"
        },
        {
          "name": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203"
        },
        {
          "name": "https://github.com/openbao/openbao/releases/tag/v2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-34fc-gh42-pj53",
        "discovery": "UNKNOWN"
      },
      "title": "OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63132",
    "datePublished": "2026-09-23T17:59:19.639Z",
    "dateReserved": "2026-07-15T16:54:55.817Z",
    "dateUpdated": "2026-09-23T19:16:11.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
View JSON API Download JSON