CVE-2025-30205: kanidm-provision Credential Leak Vulnerability

CVE-2025-30205 Overview

CVE-2025-30205 affects kanidm-provision, a helper utility that uses the kanidm API to provision users, groups, and OAuth2 systems. Prior to version 1.2.0, faulty function instrumentation in the optional kanidm patches shipped with kanidm-provision caused provisioned administrative credentials to be written to the system log. The flaw is classified under CWE-532: Insertion of Sensitive Information into Log File. Only deployments that both apply the bundled patches and provision the admin or idm_admin account credentials through this path are affected. No other credentials are exposed by this defect.

Critical Impact
Administrative credentials for admin and idm_admin accounts are written in cleartext to the system log, enabling any actor with log access to seize control of the identity management server.

Affected Products

kanidm-provision versions prior to 1.2.0
kanidm servers compiled with the bundled kanidm-provision patches
Deployments provisioning admin or idm_admin credentials through the patched flow

Discovery Timeline

2025-03-24 - CVE-2025-30205 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30205

Vulnerability Analysis

The vulnerability resides in the optional kanidm patchset distributed with kanidm-provision. The patches add an account recovery path that the utility uses to set credentials for the admin and idm_admin accounts during provisioning. The #[instrument(...)] attribute applied to the relevant async function did not exclude the password argument from tracing capture. As a result, the tracing framework recorded the password as part of the function entry span at the info log level.

Because kanidm services typically run with info-level logging enabled by default, the cleartext credentials were written to standard system logs such as journald or any centralized log aggregator collecting service output. Any operator, log forwarder, or attacker with read access to these logs can recover the privileged credentials.

Root Cause

The root cause is missing parameter exclusion in the Rust tracing instrumentation macro on the patched recovery function. The original skip(self, eventid) list did not include the password parameter, so tracing auto-emitted its Debug representation when entering the span.

Attack Vector

An attacker requires read access to host or aggregated logs that captured a provisioning run. Once obtained, the cleartext admin or idm_admin password grants full administrative control over the kanidm identity store, including the ability to mint tokens, modify OAuth2 clients, and pivot to downstream relying parties.

text

// Patch excerpt from patches/1.4.0-recover-account.patch
// security: do not log admin password in instrumentation

     #[instrument(
         level = "info",
-        skip(self, eventid),
+        skip(self, password, eventid),

Source: GitHub commit a102b52. The fix adds password to the skip list so the tracing instrumentation no longer captures the secret when the span is entered.

Detection Methods for CVE-2025-30205

Indicators of Compromise

Log entries from the kanidm server containing the recover_account span at info level with a password field populated
journald records or SIEM events referencing idm_admin or admin recovery operations that include credential material
Unexpected administrative API calls following access to historical log archives

Detection Strategies

Audit existing kanidm and host logs for the string password appearing alongside recover_account or related instrumentation spans
Review log shipping pipelines and SIEM indexes for retained copies of provisioning output that predate the upgrade
Correlate any post-provisioning authentication events for admin and idm_admin against the originating workstations and IP ranges

Monitoring Recommendations

Alert on successful authentications using the admin or idm_admin accounts outside of documented maintenance windows
Monitor for new OAuth2 client registrations, group membership changes, or credential resets performed by the built-in administrative accounts
Track read access to journal files and log archive shares on hosts that have ever run a vulnerable kanidm-provision build

How to Mitigate CVE-2025-30205

Immediate Actions Required

Rotate the admin and idm_admin credentials on every kanidm instance provisioned with a vulnerable patchset
Purge log archives, journald records, and SIEM indexes that contain captured credential material
Recompile kanidm using the patchset from tag v1.2.0 or later of kanidm-provision

Patch Information

Upgrade kanidm-provision to version 1.2.0 or later and rebuild kanidm with the updated patchset. The corrective change is documented in GitHub Security Advisory GHSA-57fc-pcqm-53rp and implemented in commit a102b52, which adds password to the tracing instrumentation skip list.

Workarounds

Set the KANIDM_LOG_LEVEL environment variable to a level higher than info, for example warn, to suppress the offending span
Restrict read access to kanidm host logs and centralized log stores to a minimal set of operators until the patch is applied
Avoid provisioning admin and idm_admin credentials through the patched recovery path until the upgrade is complete

bash

# Suppress the vulnerable instrumentation span on affected hosts
export KANIDM_LOG_LEVEL=warn
systemctl restart kanidmd