CVE-2025-52893

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.

CVSS v3 4.5 MEDIUM

4.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717	Not Applicable
https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a	Not Applicable
https://github.com/go-viper/mapstructure/pull/105	Not Applicable
https://github.com/go-viper/mapstructure/releases/tag/v2.3.0	Not Applicable
https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b30	Patch
https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-06-25 17:15

Updated : 2025-08-12 20:53

NVD link : CVE-2025-52893

Mitre link : CVE-2025-52893

CVE.ORG link : CVE-2025-52893

JSON object : View

Products Affected

openbao

openbao

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2025-52893", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2025-06-25T17:15:39.523", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717", "tags": ["Not Applicable"], "source": "[email protected]"}, {"url": "https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a", "tags": ["Not Applicable"], "source": "[email protected]"}, {"url": "https://github.com/go-viper/mapstructure/pull/105", "tags": ["Not Applicable"], "source": "[email protected]"}, {"url": "https://github.com/go-viper/mapstructure/releases/tag/v2.3.0", "tags": ["Not Applicable"], "source": "[email protected]"}, {"url": "https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b30", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients."}, {"lang": "es", "value": "OpenBao existe para proporcionar una soluci\u00f3n de software que permite gestionar, almacenar y distribuir datos confidenciales, como secretos, certificados y claves. Las versiones anteriores de OpenBao v2.3.0 pueden filtrar informaci\u00f3n confidencial en los registros al procesar datos malformados. Esto es independiente de la anterior HCSEC-2025-09 / CVE-2025-4166. Este problema se ha corregido en OpenBao v2.3.0 y posteriores. Al igual que con HCSEC-2025-09, no existe una soluci\u00f3n alternativa conocida, salvo garantizar que las solicitudes de todos los clientes tengan el formato correcto."}], "lastModified": "2025-08-12T20:53:50.083", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DBD59C4-800E-4776-A578-C3CF528D92AC", "versionEndExcluding": "2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}