OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-63132 · CVE overview and exploitation status

EUVD-2026-85520

GHSA-34fc-gh42-pj53

BIT-openbao-2026-63132

GO-2026-6553

cve-program · CVE-2026-63132

• https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53
• https://github.com/openbao/openbao/pull/3388
• https://github.com/openbao/openbao/pull/3472
• https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
• https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

euvd · EUVD-2026-85520

• https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53
• https://github.com/openbao/openbao/pull/3388
• https://github.com/openbao/openbao/pull/3472
• https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
• https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

nvd · CVE-2026-63132

• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
• https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a
• https://github.com/openbao/openbao/pull/3388
• https://github.com/openbao/openbao/pull/3472
• https://github.com/openbao/openbao/releases/tag/v2.6.0
• https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53

osv · GHSA-34fc-gh42-pj53

• https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53
• https://github.com/openbao/openbao/pull/3388
• https://github.com/openbao/openbao/pull/3472
• https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao
• https://github.com/openbao/openbao/releases/tag/v2.6.0

osv · GO-2026-6553

• https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53
• https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
• https://github.com/openbao/openbao/pull/3388
• https://github.com/openbao/openbao/pull/3472
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

No related changes are available here.