Go/github.com/openbao/openbao CVE-2026-63132: critical 9.2, EPSS 0.63%
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
Action: Upgrade github.com/openbao/openbao to 0.0.0-20260713141742-763625a20721 or later.
go get github.com/openbao/openbao@v0.0.0-20260713141742-763625a20721Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
| 0.1.0 | - | 1.1.5 |
Fixed versions
| 0.0.0-20260713141742-763625a20721 |
Sources
- osv: GHSA-34fc-gh42-pj53
- nvd: CVE-2026-63132
- https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53
- https://github.com/openbao/openbao/pull/3388
- https://github.com/openbao/openbao/pull/3472
- https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
- https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
- https://github.com/openbao/openbao
- https://github.com/openbao/openbao/releases/tag/v2.6.0
CVE-2026-63132 · published · modified · JSON