Log in Start free

Vulnerability · Published Jun 25, 2025 · Assigned by GitHub_M

CVE-2025-52893OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data

Medium 4.5

In plain English

A medium-severity sensitive data in logs in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.5Medium
Exploit odds (30 days)0.3%top 72.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22openbao2.3.1-r0ALPINE-CVE-2025-52893
Alpine:v3.23openbao2.3.1-r0ALPINE-CVE-2025-52893
Alpine:v3.24openbao2.3.1-r0ALPINE-CVE-2025-52893
Gogithub.com/openbao/openbao/sdkno fix listedGO-2025-3780
Gogithub.com/openbao/openbao/sdk/v22.3.0GO-2025-3780
Gogithub.com/openbao/openbao/sdk/v22.3.0GHSA-8f5r-8cmq-7fmq
Ubuntu:25.10golang-github-go-viper-mapstructureno fix listedUBUNTU-CVE-2025-52893
Ubuntu:26.04:LTSgolang-github-go-viper-mapstructureno fix listedUBUNTU-CVE-2025-52893
Ubuntu:26.10golang-github-go-viper-mapstructureno fix listedUBUNTU-CVE-2025-52893

Affected products (as reported)

VendorProductVersions
openbao openbao < 2.3.0

Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

References