BIT-openbao-2025-52893

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2025-52893.json

JSON Data

https://api.test.osv.dev/v1/vulns/BIT-openbao-2025-52893

Aliases

Published

2026-07-27T05:48:48Z

Modified

2026-09-08T08:47:45Z

Summary

OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data

Details

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.

Database specific

{
    "cpes": [
        "cpe:2.3:a:openbao:openbao:*:*:*:*:*:go:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / openbao

Package

Name: openbao
Purl: pkg:bitnami/openbao

Severity

4.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.3.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/openbao/BIT-openbao-2025-52893.json"