CVE-2025-52893

Published: Jun 25, 2025Modified: Jun 17, 2026

4.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Exploitability: 0.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.

Affected (1)

Products: Openbao: Openbao

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openbao Openbao	Before 2.3.0

Related CWEs

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (6)

https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717

Source: security-advisories@github.com

Not Applicable

https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a

Source: security-advisories@github.com

Not Applicable

https://github.com/go-viper/mapstructure/pull/105

Source: security-advisories@github.com

Not Applicable

https://github.com/go-viper/mapstructure/releases/tag/v2.3.0

Source: security-advisories@github.com

Not Applicable

https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b30

Source: security-advisories@github.com

Patch

https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.