Executive brief
OpenBao is a secrets management and identity platform used to secure sensitive data and access in enterprise environments. When running in recovery mode—a highly privileged administrative state—OpenBao was vulnerable to a timing attack that allowed attackers to extract the recovery token through careful observation of response times. With this token, attackers could read or modify any data within the OpenBao instance, compromising the security of all secrets it manages.
Technical details
This vulnerability is a timing attack (CWE-208: Observable Timing Discrepancy) against OpenBao's recovery token validation in recovery mode. The root cause is insufficient constant-time comparison of the recovery token during authentication, allowing attackers to extract the token character-by-character through statistical analysis of response time differences. The attack requires network access to OpenBao with recovery mode enabled and no authentication prerequisites, but involves high attack complexity due to the need for precise timing measurements and statistical analysis. A successful exploit grants full read and write access to all secrets managed by the OpenBao instance. The vulnerability was patched in OpenBao v2.6.0 and concurrently disclosed in HashiCorp Vault v2.0.3.
Affected products
- OpenBao OpenBao <2.6.0
Timeline
- 2026-07-14: disclosed
- 2026-09-22: patched: OpenBao v2.6.0 released