CVE-2025-62705: OpenBao and Vault Leak []byte Fields in Audit Logs
Impact
OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to:
- sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log. - Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log.
Third-party plugins may be affected.
This issue has been present since HashiCorp Vault and continues to impact Vault as of v1.20.4.
Patches
OpenBao v2.4.2 will patch this issue.
Workarounds
If users do not use the above functionality, they are not impacted. To prohibit the use of sys/raw globally, ensure rawstorageendpoint=false is set or missing from the server configuration.
Other sources
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62705?
CVE-2025-62705 is a critical vulnerability due to improper redaction of sensitive data in OpenBao's audit logs.
How do I fix CVE-2025-62705?
To fix CVE-2025-62705, update to the version 0.0.0-20251022165510-cc2c476bac66 or later of OpenBao.
What systems are affected by CVE-2025-62705?
CVE-2025-62705 affects versions of OpenBao prior to 0.0.0-20251022165510-cc2c476bac66.
What type of data is compromised in CVE-2025-62705?
CVE-2025-62705 compromises sensitive information emitted unredacted from subsystems, particularly when using base64 encoding.
Is CVE-2025-62705 related to data security?
Yes, CVE-2025-62705 poses significant risks to data security by potentially exposing sensitive information in audit logs.