CVE-2026-63132
2 advisories.
Go/github.com/openbao/openbao CVE-2026-63132: critical, EPSS 0.50%
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
Action: Upgrade github.com/openbao/openbao to 0.0.0-20260713141742-763625a20721 or later.
go get github.com/openbao/openbao@v0.0.0-20260713141742-763625a20721Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
| 0.1.0 | - | 1.1.5 |
Fixed versions
| 0.0.0-20260713141742-763625a20721 |
Sources
- osv: GHSA-34fc-gh42-pj53
- https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53
- https://github.com/openbao/openbao/pull/3388
- https://github.com/openbao/openbao/pull/3472
- https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
- https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
- https://github.com/openbao/openbao
- https://github.com/openbao/openbao/releases/tag/v2.6.0
CVE-2026-63132 · published · modified · JSON
Go/github.com/openbao/openbao CVE-2026-63132: unknown, EPSS 0.50%
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao
Action: Upgrade github.com/openbao/openbao to 0.0.0-20260713141742-763625a20721 or later.
go get github.com/openbao/openbao@v0.0.0-20260713141742-763625a20721Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
| 0.0.0-20260713141742-763625a20721 |
Sources
- osv: GO-2026-6553
- https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53
- https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8
- https://github.com/openbao/openbao/pull/3388
- https://github.com/openbao/openbao/pull/3472
- https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203
- https://github.com/openbao/openbao/releases/tag/v2.6.0
CVE-2026-63132 · published · modified · JSON