OpenBao up to 2.4.1 log file

Summaryinfo

A vulnerability, which was classified as problematic, was found in OpenBao up to 2.4.1. This vulnerability affects unknown code. Such manipulation leads to log file. This vulnerability is listed as CVE-2025-62705. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in OpenBao up to 2.4.1. Affected by this issue is some unknown functionality. The manipulation with an unknown input leads to a log file vulnerability. Using CWE to declare the problem leads to CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. Impacted is confidentiality. CVE summarizes:

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-62705 since 10/20/2025. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 272073 (Fedora 43 : openbao (2025-0687b2debc)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.4.2 eliminates this vulnerability. Applying the patch cc2c476bac66e1d94776c2629793daec3af625f8 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (272073). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• OpenBao

Version

• 2.4.0
• 2.4.1

License

• open-source

Website

• Product: https://github.com/openbao/openbao/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion