OpenBao leaks HTTPRawBody in Audit Logs (CVE-2025-62513)

OpenBao, an open source identity-based secrets management system, had a regression in its audit logging mechanism in versions 2.2.0 to 2.4.1. Specifically, raw HTTP bodies used by certain endpoints were not correctly redacted (HMAC'd), leading to leakage of sensitive data in audit logs. This impacts users of the ACME functionality of PKI, where short-lived ACME verification challenge codes could be exposed, and users of the OIDC issuer functionality, where authentication and token response codes along with claims could be leaked. The ACME codes are short-lived and become unusable after verification or challenge expiry. The vulnerability has been fixed in OpenBao version 2.4.2.

Sensitive short-lived ACME verification challenge codes and OIDC authentication and token response data may be exposed in audit logs due to improper redaction. While ACME codes have limited long-term use due to their short validity, exposure of OIDC tokens and claims could have security implications depending on log access controls. No known exploits in the wild have been reported.

A patch is available and should be applied by upgrading OpenBao to version 2.4.2 or later. Users should review audit logs for sensitive data exposure and rotate any potentially compromised tokens or credentials if applicable.