CVE-2025-62705 - CVE House
Back to Database
Status published Medium CVE-2025-62705

OpenBao and Vault Leak []byte Fields in Audit Logs

Vulnerability Description

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62705

Credits & Attribution

No credits recorded in the NVD database.

References

More from openbao

View All →
CVE-2025-64761
OpenBao Privileged Operator Identity Group Root Escalation
High 7.5
CVE-2025-62513
OpenBao leaks HTTPRawBody in Audit Logs
Medium 5.7
CVE-2025-59048
OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method
High 8.1
CVE-2025-59043
OpenBao vulnerable to denial of service via malicious JSON request processing
High 7.5
CVE-2025-55003
OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse
Medium 5.7

Affected Vendor

Affected Software

openbao
Vulnerable Versions:
< 2.4.2

Timeline

Official Publish: October 22nd, 2025
Last Modified: October 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-532

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1555 Credentials from Password Stores
Credential Access
T1078 Valid Accounts
Persistence
T1562 Impair Defenses
Defense Evasion