{"action":"Upgrade github.com/openbao/openbao to 0.0.0-20260713141742-763625a20721 or later.","affected":[{"introduced":"0"}],"component":"github.com/openbao/openbao","cve_ids":["CVE-2026-63132"],"ecosystem":"Go","epss":0.00497,"exploited":false,"fixed_versions":["0.0.0-20260713141742-763625a20721"],"ghsa_id":"GHSA-34fc-gh42-pj53","id":"tcs_01M5KGVC2GDAR5A7WQH1T3CSTR","modified_at":"2026-10-01T20:56:02.382665254Z","published_at":"2026-10-01T20:23:38Z","references":["https://osv.dev/vulnerability/GO-2026-6553","https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53","https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8","https://github.com/openbao/openbao/pull/3388","https://github.com/openbao/openbao/pull/3472","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6553","url":"https://osv.dev/vulnerability/GO-2026-6553"}],"summary":"OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao"}