GHSA-q8cj-789h-vg24

Source

https://github.com/advisories/GHSA-q8cj-789h-vg24

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-q8cj-789h-vg24/GHSA-q8cj-789h-vg24.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-q8cj-789h-vg24

Aliases

Published

2026-05-28T17:52:43Z

Modified

2026-08-17T08:10:55Z

Severity

5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenBao's Inline Auth Incorrectly Redacted Headers

Details

Impact

OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate.

Patches

This is fixed in OpenBao v2.5.4.

Resources

https://github.com/openbao/openbao/issues/3074

Database specific

{
    "cwe_ids":  [
        "CWE-532"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-28T17:52:43Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/openbao/openbao

Package

Name: github.com/openbao/openbao; View open source insights on deps.dev
Purl: pkg:golang/github.com/openbao/openbao

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.5.4

Database specific

last_known_affected_version_range

"<= 2.5.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-q8cj-789h-vg24/GHSA-q8cj-789h-vg24.json"