CVE-2026-63132

The open source secrets management system OpenBao is vulnerable to a timing attack against its recovery token in versions prior to 2.6.0 . The root cause lies in the handleLogicalRecovery path within http/logical.go, where the system compared the highly privileged recovery token using ordinary st...