CVE-2025-62705Medium▾ SunlitOpenBao and Vault Leak []byte Fields in Audit Logs
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
0.3% → 0.3%
OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to:
sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log.Third-party plugins may be affected.
This issue has been present since HashiCorp Vault and continues to impact Vault as of v1.20.4.
OpenBao v2.4.2 will patch this issue.
If users do not use the above functionality, they are not impacted. To prohibit the use of sys/raw globally, ensure raw_storage_endpoint=false is set or missing from the server configuration.
github.com/openbao/openbao < 0.0.0-20251022165510-cc2c476bac66Upgrade to a patched release:
github.com/openbao/openbao 0.0.0-20251022165510-cc2c476bac66Connected by shared product, vendor, weakness, or advisory.
CVE-2025-62513MediumOpenBao leaks HTTPRawBody in Audit Logs
CVE-2026-45808HighOpenBao is an open source identity-based secrets management system
CVE-2026-46358MediumOpenBao is an open source identity-based secrets management system
CVE-2026-46405Medium· 5.3OpenBao is an open source identity-based secrets management system
CVE-2025-54997Critical· 9.1Privileged OpenBao Operator May Execute Code on the Underlying Host
CVE-2026-42186LowOpenBao's Namespace Deletion May Not Delete Data Properly