Go/github.com/openbao/openbao CVE-2026-63132: unknown

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao

Action: Upgrade github.com/openbao/openbao to 0.0.0-20260713141742-763625a20721 or later.

go get github.com/openbao/openbao@v0.0.0-20260713141742-763625a20721

Affected

Fixed versions

Sources

• osv: GO-2026-6553
• https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53
• https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
• https://github.com/openbao/openbao/pull/3388
• https://github.com/openbao/openbao/pull/3472
• https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
• https://github.com/openbao/openbao/releases/tag/v2.6.0

CVE-2026-63132 · published 2026-10-01T20:23:38Z · modified 2026-10-01T20:56:02.382665254Z · JSON