CRITICAL
GHSA-34fc-gh42-pj53
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
Quick fix
GHSA-34fc-gh42-pj53 — github.com/openbao/openbao: upgrade to the fixed version with the command below.
go get github.com/openbao/openbao@v0.0.0-20260713141742-763625a20721Details
### Impact
When running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of data.
### Patches
This has been patched in OpenBao v2.6.0.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/openbao/openbao
Introduced in:
0Fixed in: 0.0.0-20260713141742-763625a20721Fix
go get github.com/openbao/openbao@v0.0.0-20260713141742-763625a20721Go/github.com/openbao/openbao
Introduced in:
0.1.0No fixed version published yet for github.com/openbao/openbao (go modules). Pin to a known-safe version or switch to an alternative.
References
- https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53[WEB]
- https://github.com/openbao/openbao/pull/3388[WEB]
- https://github.com/openbao/openbao/pull/3472[WEB]
- https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8[WEB]
- https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203[WEB]
- https://github.com/openbao/openbao[PACKAGE]
- https://github.com/openbao/openbao/releases/tag/v2.6.0[WEB]