CVE-2025-52893
OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.
Reserved 2025-06-20 | Published 2025-06-25 | Updated 2025-06-25 | Assigner GitHub_MCWE-532: Insertion of Sensitive Information into Log File
github.com/...penbao/security/advisories/GHSA-8f5r-8cmq-7fmq
github.com/go-viper/mapstructure/pull/105
github.com/...ommit/ed3f92181528ff776a0324107b8b55026e93766a
github.com/...ommit/cf5e920badbf96b41253534a3fd5ff5063bf4b30
discuss.hashicorp.com/...ed-data-with-the-kv-v2-plugin/74717
github.com/go-viper/mapstructure/releases/tag/v2.3.0
Support options
