Bug 2539618 (CVE-2026-63132)

Summary:	CVE-2026-63132 OpenBao: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, anjoseph, cmah, eaguilar, ebaron, jmatsuok, jprabhak, jtolenti, pjindal, wtam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in OpenBao, an open source identity-based secrets management system. A remote unauthenticated attacker could exploit a timing attack vulnerability in the `handleLogicalRecovery` path to infer a highly privileged recovery token. This token could then be used to authorize recovery mode operations, leading to unauthorized reading or modification of OpenBao data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-23 18:23:59 UTC

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.