CVE-2025-62513: OpenBao leaks HTTPRawBody in Audit Logs
Impact
OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacted the following subsystems:
- When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs. - When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs.
Third-party plugins may be affected.
Patches
OpenBao v2.4.2 will patch this issue.
Workarounds
If users do not use the above functionality, they are not impacted. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use.
Other sources
OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62513?
The severity of CVE-2025-62513 has not been explicitly defined, but it involves exposure of sensitive data in audit logs due to improper redaction.
How do I fix CVE-2025-62513?
To fix CVE-2025-62513, update OpenBao to version 0.0.0-20251022165510-cc2c476bac66 or a later version that addresses the issue.
What systems are affected by CVE-2025-62513?
CVE-2025-62513 affects OpenBao versions 2.2.0 to 2.4.1 when using specific HTTP endpoints.
What is the impact of CVE-2025-62513?
The impact of CVE-2025-62513 is the potential exposure of sensitive information in raw HTTP bodies of audit logs.
When was CVE-2025-62513 disclosed?
CVE-2025-62513 was disclosed in an advisory on GitHub, highlighting the regression in the audit logging functionality.