{"action":"Upgrade github.com/openbao/openbao to 0.0.0-20260713141742-763625a20721 or later.","affected":[{"introduced":"0"},{"introduced":"0.1.0","last_affected":"1.1.5"}],"component":"github.com/openbao/openbao","cve_ids":["CVE-2026-63132"],"ecosystem":"Go","epss":0.00629,"exploited":false,"fixed_versions":["0.0.0-20260713141742-763625a20721"],"ghsa_id":"GHSA-34fc-gh42-pj53","id":"tcs_01M5KET5M3ZFFJZB97SB1V7KZE","modified_at":"2026-10-01T20:56:02.382665254Z","published_at":"2026-09-22T20:36:51Z","references":["https://osv.dev/vulnerability/GHSA-34fc-gh42-pj53","https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53","https://github.com/openbao/openbao/pull/3388","https://github.com/openbao/openbao/pull/3472","https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"severity":{"label":"critical","score":9.2},"sources":[{"source":"osv","source_id":"GHSA-34fc-gh42-pj53","url":"https://osv.dev/vulnerability/GHSA-34fc-gh42-pj53"},{"source":"nvd","source_id":"CVE-2026-63132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63132"}],"summary":"OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack"}