OpenBao versions before 2.6.3 and between 2.7.0 and before 2.7.1 have an information disclosure vulnerability. Attackers can cause sensitive data to be leaked into audit logs by sending malformed plugin parameters, specifically malformed TypeKVPair or TypeHeader field values. This results in error messages containing sensitive input being recorded in audit logs.