CVE-2025-62705

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8	Patch
https://github.com/openbao/openbao/security/advisories/GHSA-rc54-2g2c-g36g	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) OpenBao es un sistema de gestión de secretos de código abierto basado en identidad. Antes de la versión 2.4.2, el registro de auditoría de OpenBao no redactaba apropiadamente los campos cuando los subsistemas relevantes enviaban parámetros de respuesta de tipo []byte en lugar de cadenas de texto. Esto incluye, pero no se limita a sys/raw con el uso de encoding=base64, donde todos los datos se emitirían sin redactar al registro de auditoría, y Transit, al realizar una operación de firma con una clave Ed25519 derivada, emitiría claves públicas al registro de auditoría. Este problema ha sido parcheado en OpenBao 2.4.2.

Information

Published : 2025-10-22 22:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-62705

Mitre link : CVE-2025-62705

CVE.ORG link : CVE-2025-62705

JSON object : View

Products Affected

openbao

openbao

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2025-62705", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62705", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-23T15:48:38.845519Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "openbao", "product": "openbao", "versions": [{"status": "affected", "version": "< 2.4.2"}]}]}], "published": "2025-10-22T22:15:35.420", "references": [{"url": "https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openbao/openbao/security/advisories/GHSA-rc54-2g2c-g36g", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2."}, {"lang": "es", "value": "OpenBao es un sistema de gesti\u00f3n de secretos de c\u00f3digo abierto basado en identidad. Antes de la versi\u00f3n 2.4.2, el registro de auditor\u00eda de OpenBao no redactaba apropiadamente los campos cuando los subsistemas relevantes enviaban par\u00e1metros de respuesta de tipo []byte en lugar de cadenas de texto. Esto incluye, pero no se limita a sys/raw con el uso de encoding=base64, donde todos los datos se emitir\u00edan sin redactar al registro de auditor\u00eda, y Transit, al realizar una operaci\u00f3n de firma con una clave Ed25519 derivada, emitir\u00eda claves p\u00fablicas al registro de auditor\u00eda. Este problema ha sido parcheado en OpenBao 2.4.2."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "047EBE1D-5A8E-4B0D-BC28-310EEE9C9D0A", "versionEndExcluding": "2.4.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}