OpenBao and Vault Leak []byte Fields in Audit Logs (CVE-2025-62705)
Description
OpenBao versions prior to 2.4.2 have an issue where audit logs do not properly redact []byte fields. This results in sensitive data such as base64-encoded raw system data and public keys used in signing operations being logged in cleartext. The vulnerability has been addressed in version 2.4.2.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenBao, an open source identity-based secrets management system, had a vulnerability (CVE-2025-62705) where audit logs failed to redact []byte response parameters properly. Specifically, subsystems like sys/raw with encoding=base64 and the Transit subsystem performing Ed25519 signing operations emitted sensitive data, including public keys, unredacted in audit logs. This could lead to unintended exposure of sensitive cryptographic material in logs. The issue was fixed in OpenBao version 2.4.2.
Potential Impact
Sensitive data such as base64-encoded raw system data and public keys used in cryptographic signing operations could be exposed in audit logs. This exposure may lead to information disclosure risks, potentially aiding attackers in reconnaissance or cryptographic attacks if logs are accessed by unauthorized parties.
Mitigation Recommendations
Upgrade OpenBao to version 2.4.2 or later, where the audit log redaction issue has been fixed. No additional mitigation is required once the patch is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-openbao-2025-62705
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2025-62705"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Patch Information
Threat ID: 6aa005f6acd9273b49ab63b5
Added to database: 09/08/2026, 12:56:22 UTC
Last enriched: 09/08/2026, 13:32:12 UTC
Last updated: 10/22/2026, 01:15:19 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.