CVE-2026-63132

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63132", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-15T16:54:55.817Z", "datePublished": "2026-09-23T17:59:19.639Z", "dateUpdated": "2026-09-23T19:16:11.327Z"}, "containers": {"cna": {"title": "OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack", "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "lang": "en", "description": "CWE-208: Observable Timing Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53"}, {"name": "https://github.com/openbao/openbao/pull/3388", "tags": ["x_refsource_MISC"], "url": "https://github.com/openbao/openbao/pull/3388"}, {"name": "https://github.com/openbao/openbao/pull/3472", "tags": ["x_refsource_MISC"], "url": "https://github.com/openbao/openbao/pull/3472"}, {"name": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8", "tags": ["x_refsource_MISC"], "url": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8"}, {"name": "https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a", "tags": ["x_refsource_MISC"], "url": "https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a"}, {"name": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203", "tags": ["x_refsource_MISC"], "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203"}, {"name": "https://github.com/openbao/openbao/releases/tag/v2.6.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"}], "affected": [{"vendor": "openbao", "product": "openbao", "versions": [{"version": "< 2.6.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-23T17:59:19.639Z"}, "descriptions": [{"lang": "en", "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0."}], "source": {"advisory": "GHSA-34fc-gh42-pj53", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T19:13:35.308605Z", "id": "CVE-2026-63132", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T19:16:11.327Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-23T19:13:35.308605Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T19:14:01.886Z"}}], "cna": {"title": "OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack", "source": {"advisory": "GHSA-34fc-gh42-pj53", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openbao", "product": "openbao", "versions": [{"status": "affected", "version": "< 2.6.0"}]}], "references": [{"url": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53", "name": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openbao/openbao/pull/3388", "name": "https://github.com/openbao/openbao/pull/3388", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openbao/openbao/pull/3472", "name": "https://github.com/openbao/openbao/pull/3472", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8", "name": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a", "name": "https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203", "name": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openbao/openbao/releases/tag/v2.6.0", "name": "https://github.com/openbao/openbao/releases/tag/v2.6.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208: Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-23T17:59:19.639Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63132", "state": "PUBLISHED", "dateUpdated": "2026-09-23T19:16:11.327Z", "dateReserved": "2026-07-15T16:54:55.817Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-23T17:59:19.639Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openbao", "vendor": "openbao", "versions": [{"status": "affected", "version": "< 2.6.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0."}], "id": "CVE-2026-63132", "lastModified": "2026-09-29T19:06:32.333", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63132", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T19:13:35.308605Z", "version": "2.0.3"}}]}, "published": "2026-09-23T19:17:34.663", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203"}, {"source": "security-advisories@github.com", "url": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8"}, {"source": "security-advisories@github.com", "url": "https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a"}, {"source": "security-advisories@github.com", "url": "https://github.com/openbao/openbao/pull/3388"}, {"source": "security-advisories@github.com", "url": "https://github.com/openbao/openbao/pull/3472"}, {"source": "security-advisories@github.com", "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "OpenBao: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack", "id": "2539618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539618"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-208", "details": ["OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.", "A flaw was found in OpenBao, an open source identity-based secrets management system. A remote unauthenticated attacker could exploit a timing attack vulnerability in the `handleLogicalRecovery` path to infer a highly privileged recovery token. This token could then be used to authorize recovery mode operations, leading to unauthorized reading or modification of OpenBao data."], "name": "CVE-2026-63132", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "dex", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentofu1.10", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "opentofu1.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentofu1.12", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/dex-rhel9", "product_name": "Red Hat OpenShift GitOps"}], "public_date": "2026-09-23T17:59:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63132\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63132\nhttps://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203\nhttps://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8\nhttps://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a\nhttps://github.com/openbao/openbao/pull/3388\nhttps://github.com/openbao/openbao/pull/3472\nhttps://github.com/openbao/openbao/releases/tag/v2.6.0\nhttps://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.6.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openbao", "source": "cna", "vendor": "openbao"}, "product": "openbao", "vendor": "openbao"}], "created": "2026-09-23T20:00:08.602161+00:00", "updated": "2026-09-23T20:45:10.000116+00:00", "vendors": ["openbao", "openbao$PRODUCT$openbao"]}