Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-52893: OpenBao may expose secret data in logs

CVE-2025-52893 · published 1 year ago

Summary

Versions of OpenBao before 2.3.0 can write sensitive information, such as passwords or keys, to log files when they receive malformed input. This could allow anyone with access to the logs to see that data. Upgrade to OpenBao 2.3.0 or later and make sure all client requests are correctly formatted.

What to do

Update github.com openbao to version 2.3.0.
Update openbao openbao to version 2.3.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	github.com	openbao	< 2.3.0 Fix: upgrade to 2.3.0
–	openbao	openbao	< 2.3.0 `cpe:2.3:a:openbao:openbao::::::::`
Ubuntu:25.10	canonical	golang-github-go-viper-mapstructure	All versions

Original advisory text

OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.

References

https://github.com/advisories/GHSA-8f5r-8cmq-7fmq
https://nvd.nist.gov/vuln/detail/CVE-2025-52893 Vendor Advisory
https://ubuntu.com/security/CVE-2025-52893 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-52893 Third Party Advisory
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-informa... URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52893... Vendor Advisory
https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b5502... Patch
https://github.com/go-viper/mapstructure/releases/tag/v2.3.0 URL
https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq Vendor Advisory
https://github.com/go-viper/mapstructure/pull/105 Patch
https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-532Insertion of Sensitive Information into Log File

Timeline

Published25 Jun 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-8f5r-8cmq-7fmq · GHSA

CVE-2025-52893 · NVD

UBUNTU-CVE-2025-52893 · OSV

CVE-2025-52893 · OSV

Track software like this

Free during beta