CVE-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

Critical 9.2 Published 23 Sep 2026 Updated 23 Sep 2026

Remote attackers can infer the recovery token via timing attacks in recovery mode, enabling unauthorized data access and modification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-63132?

CVE-2026-63132 is a critical vulnerability in openbao, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.

Weakness: CWE-208

Which versions are affected by CVE-2026-63132?

6 open source packages ship an affected version, including github.com/openbao/openbao and openbao.

Package	Affected	Fixed in
`github.com/openbao/openbao` Go	All versions	`0.0.0-20260713141742-763625a20721`
`github.com/openbao/openbao` Go	All versions	`0.0.0-20260713141742-763625a20721`
`github.com/openbao/openbao` Go	All versions	`0.0.0-20260713141742-763625a20721`
`github.com/openbao/openbao` Go	From `0.1.0` to `1.1.5`	None
`github.com/openbao/openbao` Go	From `0.1.0` to `1.1.5`	None
`openbao` Bitnami	All versions	`2.6.0`

How do I fix CVE-2026-63132?

Upgrade github.com/openbao/openbao to 0.0.0-20260713141742-763625a20721 or later.

Is CVE-2026-63132 being exploited?

There is no known exploitation of CVE-2026-63132 in the wild and no public exploit code.

Sources

Also known as BIT-openbao-2026-63132, GHSA-34fc-gh42-pj53, GO-2026-6553, MINI-c767-v34m-8j6w, MINI-www8-3wjc-g53r.