| id: GO-2026-6553 |
| modules: |
| - module: github.com/openbao/openbao |
| versions: |
| - fixed: 0.0.0-20260713141742-763625a20721 |
| - introduced: 0.1.0 |
| unsupported_versions: |
| - last_affected: 1.1.5 |
| summary: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao |
| cves: |
| - CVE-2026-63132 |
| ghsas: |
| - GHSA-34fc-gh42-pj53 |
| references: |
| - advisory: https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53 |
| - fix: https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8 |
| - fix: https://github.com/openbao/openbao/pull/3388 |
| - fix: https://github.com/openbao/openbao/pull/3472 |
| - web: https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203 |
| - web: https://github.com/openbao/openbao/releases/tag/v2.6.0 |
| notes: |
| - fix: 'github.com/openbao/openbao: could not add vulnerable_at: latest version (0.0.0-20260714213526-4771dc118499) is before last introduced version' |
| source: |
| id: GHSA-34fc-gh42-pj53 |
| created: 2026-09-28T14:11:04.722989-04:00 |
| review_status: UNREVIEWED |
