CVE-2025-52893 | THREATINT

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.

PUBLISHED Reserved 2025-06-20 | Published 2025-06-25 | Updated 2025-06-25 | Assigner GitHub_M

MEDIUM: 4.5CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Problem types

CWE-532: Insertion of Sensitive Information into Log File

Product status

< 2.3.0

affected

References

github.com/...penbao/security/advisories/GHSA-8f5r-8cmq-7fmq

github.com/go-viper/mapstructure/pull/105

github.com/...ommit/ed3f92181528ff776a0324107b8b55026e93766a

github.com/...ommit/cf5e920badbf96b41253534a3fd5ff5063bf4b30

discuss.hashicorp.com/...ed-data-with-the-kv-v2-plugin/74717

github.com/go-viper/mapstructure/releases/tag/v2.3.0

cve.org (CVE-2025-52893)

nvd.nist.gov (CVE-2025-52893)

Download JSON