Skip to content
OpenAdvisories
Medium · 5.7 CVE-2025-62705 BIT-openbao-2025-62705EUVD-2025-35629GHSA-rc54-2g2c-g36gGO-2025-4052

OpenBao and Vault Leak []byte Fields in Audit Logs

Published Oct 22, 2025 · Updated Oct 23, 2025 · Assigned by GitHub_M

Description

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.

Affected products

VendorProductAffectedFixed
openbao openbao < 2.4.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20251105T184115-1.1 openSUSE-SU-2025:15710-1
openSUSE Tumbleweed openbao 2.4.3-1.1 openSUSE-SU-2025:15663-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
ReleasePackageFixed inAdvisory
Alpine v3.24 openbao 2.4.3-r0 —
Alpine v3.23 openbao 2.4.3-r0 —
Alpine v3.22 openbao 2.4.3-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/openbao/openbao < 0.0.0-20251022165510-cc2c476bac66 0.0.0-20251022165510-cc2c476bac66 GHSA-rc54-2g2c-g36g

Advisories 4

References