Vulnerability · Published Oct 22, 2025 · Assigned by GitHub_M
CVE-2025-62705OpenBao and Vault Leak []byte Fields in Audit Logs
Medium 5.7
In plain English
A medium-severity sensitive data in logs in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | openbao | 2.4.3-r0 | ALPINE-CVE-2025-62705 |
| Alpine:v3.23 | openbao | 2.4.3-r0 | ALPINE-CVE-2025-62705 |
| Alpine:v3.24 | openbao | 2.4.3-r0 | ALPINE-CVE-2025-62705 |
| Go | github.com/openbao/openbao | 0.0.0-20251022165510-cc2c476bac66 | GHSA-rc54-2g2c-g36g |
| Go | github.com/openbao/openbao | 0.0.0-20251022165510-cc2c476bac66 | GO-2025-4052 |
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N