Skip to content
Threat Feed
Subscribe

Tag

Secrets-Management

2 briefs RSS
critical advisory

OpenBao Recovery Mode Timing Attack

OpenBao recovery mode is vulnerable to a timing attack (CVE-2026-63132) that allows an unauthenticated attacker to exfiltrate the recovery token and gain administrative control.

OpenBao +1 credential-access vulnerability privilege-escalation secrets-management cve-2026-71543
2t
high advisory

OpenBao Cross-Namespace Lease Revocation via Legacy sys/revoke Path

OpenBao versions up to 2.5.3 allow cross-namespace lease revocation by exploiting legacy sys/revoke endpoints, potentially leading to unauthorized credential access and denial of service.

openbao/openbao vulnerability acl-bypass secrets-management
2r 1t