Identity-Based Secrets Management System Vulnerability in OpenBao
CVE-2026-63132

9.2CRITICAL

Key Information:

Vendor

Openbao

Status
Openbao
Vendor
CVE Published:
23 September 2026

What is CVE-2026-63132?

OpenBao, an open source identity-based secrets management system, has a vulnerability related to how it handles the recovery token in its logical recovery process. Prior to version 2.6.0, the recovery token was compared using ordinary string equality, which was insufficiently secure. An unauthenticated attacker could exploit this vulnerability by sending repeated requests in recovery mode, using timing analysis to infer the recovery token. If successfully obtained, this token could allow unauthorized access to sensitive recovery operations, enabling the attacker to read or modify data within OpenBao. This issue has been addressed in version 2.6.0.

Affected Version(s)

openbao < 2.6.0

References

https://github.com/openbao/openbao/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openbao/openbao/pull/3388
x_refsource_MISC
https://github.com/openbao/openbao/pull/3472
x_refsource_MISC

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.