Is CVE-2026-63132 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63132 being exploited in the wild.

How severe is CVE-2026-63132?

Critical severity, with a CVSS score of 4, published 23 September 2026.

Which products and versions are affected?

github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260713141742-763625a20721, SEMVER:introduced=0,fixed=0.0.0-20260713141742-763625a20721,introduced=0.1.0; OpenBao <2.6.0.

Is there a fix for CVE-2026-63132?

Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260713141742-763625a20721 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63132 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63132?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63132: OpenBao recovery mode timing attack token leakage

Q: Is there a fix for CVE-2026-63132?

Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260713141742-763625a20721 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-63132 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-63132?

Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63132 · Severity: critical · CVSS 4 · Published 2026-09-23

OpenBao is a secrets management and identity platform used to secure sensitive data and access in enterprise environments. When running in recovery mode—a highly privileged administrative state—OpenBao was vulnerable to a timing attack that allowed attackers to extract the recovery token through careful observation of response times. With this token, attackers could read or modify any data within the OpenBao instance, compromising the security of all secrets it manages.

Technologies: github.com/openbao/openbao (Go), OpenBao. Vendors: Go, OpenBao.

Quick answers

Is CVE-2026-63132 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63132 being exploited in the wild.
How severe is CVE-2026-63132?: Critical severity, with a CVSS score of 4, published 23 September 2026.
Which products and versions are affected?: github.com/openbao/openbao (Go) SEMVER:introduced=0,fixed=0.0.0-20260713141742-763625a20721, SEMVER:introduced=0,fixed=0.0.0-20260713141742-763625a20721,introduced=0.1.0; OpenBao <2.6.0.
Is there a fix for CVE-2026-63132?: Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20260713141742-763625a20721 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63132 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63132?: Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openbao/openbao (Go): upgrade to 0.0.0-20260713141742-763625a20721 or later
```
go get github.com/openbao/openbao@v0.0.0-20260713141742-763625a20721
```

Technical details

This vulnerability is a timing attack (CWE-208: Observable Timing Discrepancy) against OpenBao's recovery token validation in recovery mode. The root cause is insufficient constant-time comparison of the recovery token during authentication, allowing attackers to extract the token character-by-character through statistical analysis of response time differences. The attack requires network access to OpenBao with recovery mode enabled and no authentication prerequisites, but involves high attack complexity due to the need for precise timing measurements and statistical analysis. A successful exploit grants full read and write access to all secrets managed by the OpenBao instance. The vulnerability was patched in OpenBao v2.6.0 and concurrently disclosed in HashiCorp Vault v2.0.3.

Affected products

OpenBao OpenBao <2.6.0

Identifiers

CVE-2026-63132
BIT-OPENBAO-2026-63132
GHSA-34fc-gh42-pj53
GO-2026-6553

Timeline

2026-07-14: disclosed
2026-09-22: patched: OpenBao v2.6.0 released

References

https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.