Description
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openbao | openbao | < 2.5.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openbao | 2.5.4-1.1 | openSUSE-SU-2026:10835-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openbao | 2.5.4-r0 | — |
| Alpine v3.23 | openbao | 2.5.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/openbao/openbao | < 2.5.4 | 2.5.4 | GHSA-q8cj-789h-vg24 |
| Go | github.com/openbao/openbao | all versions | — | GO-2026-5574 |
Advisories 3
- WID-SEC-2026-1632 OpenBao: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- openSUSE-SU-2026:10835-1 openbao-2.5.4-1.1 on GA media SUSE / openSUSE Security Updates · May 22, 2026
References
- https://github.com/openbao/openbao/security/advisories/GHSA-q8cj-789h-vg24
- https://github.com/openbao/openbao/issues/3074
- https://github.com/openbao/openbao/pull/3076
- https://github.com/openbao/openbao/commit/131c6966af4dfb4e1906703436eecdb8f2a3e9df
- https://github.com/openbao/openbao/releases/tag/v2.5.4