Medium severity · published Jun 25, 2025
CVE-2025-52893
OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data
4.5
CVSS
0.3%
EPSS
No
On KEV
Description
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openbao · openbao
< 2.3.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52893
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52893
Not Applicable
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
Not Applicable
https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a
Not Applicable
https://github.com/go-viper/mapstructure/pull/105
Not Applicable
https://github.com/go-viper/mapstructure/releases/tag/v2.3.0
Patch
https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b30
Vendor Advisory
https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq
More from openbao
9.8
CVE-2024-2048
Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates
9.2
CVE-2026-63132
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
9.1
CVE-2025-54997
OpenBao: Privileged Operator May Execute Code on the Underlying Host
8.8
CVE-2024-7594
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default
8.3
CVE-2026-33757
OpenBao lacks user confirmation for OIDC direct callback mode