CVE-2025-62705: OpenBao Audit Log Information Disclosure

CVE-2025-62705 Overview

CVE-2025-62705 affects OpenBao, an open source identity-based secrets management system. Versions prior to 2.4.2 fail to redact sensitive []byte response parameters in audit logs. When subsystems return byte slices instead of strings, the audit formatter emits the raw data unredacted. This affects sys/raw requests using encoding=base64 and the Transit engine when signing with derived Ed25519 keys. Operators reviewing audit logs may inadvertently expose secret material, backend data, or derived public key information to any user with audit log access. The maintainers patched the issue in OpenBao 2.4.2. The vulnerability is classified under CWE-532: Insertion of Sensitive Information into Log File.

Critical Impact
Sensitive []byte response data — including base64-encoded raw storage values and Transit-derived Ed25519 public keys — is written to audit logs without redaction, exposing secret material to any user with log access.

Affected Products

OpenBao versions prior to 2.4.2
OpenBao sys/raw endpoint when invoked with encoding=base64
OpenBao Transit secrets engine performing signing with derived Ed25519 keys

Discovery Timeline

2025-10-22 - CVE-2025-62705 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62705

Vulnerability Analysis

OpenBao's audit subsystem inspects response data and elides or hashes sensitive fields before writing entries to the audit log. The redaction logic in audit/format.go handled string-typed response parameters correctly but did not cover response fields returned as []byte. Any backend returning a byte slice bypassed elision, and the raw bytes were serialized into audit records.

Two concrete impact paths are documented. First, sys/raw reads with encoding=base64 return storage payloads as byte slices; the base64-encoded contents landed in the audit log verbatim. Second, the Transit engine's signing operation using derived Ed25519 keys returned the derived public key as []byte, exposing per-context public key material to log readers. Log-based information disclosure erodes the trust boundary between operators reading audit output and holders of the underlying secrets.

Root Cause

The audit formatter's type switch handled string and list forms but omitted the []byte case. Without a matching branch, byte-slice response parameters skipped both elision and hashing paths and were emitted directly, mapping to [CWE-532].

Attack Vector

Exploitation requires a caller with high privileges to invoke an affected endpoint, such as sys/raw with base64 encoding or a Transit sign operation with a derived Ed25519 key. The sensitive material then leaks to any principal with read access to audit log sinks.

// Patch excerpt from audit/format.go — refactor of audit log formatting
// Source: https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8
func doElideListResponseData(data map[string]interface{}) {
	for k, v := range data {
		switch k {
		case "keys":
			if vSlice, ok := v.([]interface{}); ok {
				data[k] = len(vSlice)
			} else if vSlice, ok := v.([]string); ok {
				data[k] = len(vSlice)
			}
		}
	}
}

The accompanying changelog entry documents the fix: audit: redact []byte type response parameters in audit logs; GHSA-rc54-2g2c-g36g.

Detection Methods for CVE-2025-62705

Indicators of Compromise

Audit log entries from sys/raw operations containing long base64 strings in the response.data.value field rather than a redacted placeholder.
Audit log entries from Transit sign operations against derived Ed25519 keys containing a public_key field with raw key bytes present.
Audit sink files or forwarded streams containing high-entropy fields that were expected to be hashed or elided.

Detection Strategies

Grep historical audit logs for sys/raw request paths combined with encoding=base64 and non-empty response value fields to identify exposed storage reads.
Query audit log stores for Transit sign operations where derived=true and a populated public_key byte string is present in the response.
Compare deployed OpenBao binary versions against 2.4.2 using inventory data and flag any host running an older release.

Monitoring Recommendations

Forward OpenBao audit logs to a centralized log platform and apply detections for unredacted response payloads on privileged paths.
Alert on read access to audit log sinks by principals outside the operator group, given the exposure of secret material in older logs.
Track use of sys/raw in production, which should be rare, and treat any post-vulnerability usage on unpatched instances as an incident.

How to Mitigate CVE-2025-62705

Immediate Actions Required

Upgrade OpenBao to version 2.4.2 or later on all servers and standby nodes before restoring normal operations.
Rotate any secrets that were read through sys/raw with base64 encoding while audit logs were accessible to non-operator principals.
Rotate Transit derived Ed25519 signing contexts if the exposed derived public keys represent identifiable subjects that require unlinkability.
Purge or restrict access to historical audit logs that may contain unredacted []byte response data.

Patch Information

The fix is included in OpenBao 2.4.2. See the GitHub Security Advisory GHSA-rc54-2g2c-g36g and the upstream commit cc2c476 for full remediation details.

Workarounds

Restrict sys/raw access through policy so that no token can invoke the endpoint until upgrade is complete.
Disable use of derived Ed25519 keys in Transit until the OpenBao binaries are updated to 2.4.2.
Tighten filesystem and forwarding permissions on audit device sinks so only trusted operators can read historical entries.

bash

# Deny sys/raw and Transit derived signing on unpatched clusters
cat <<'EOF' | bao policy write restrict-raw-transit -
path "sys/raw/*" {
  capabilities = ["deny"]
}
path "transit/sign/+/*" {
  capabilities = ["deny"]
}
EOF

# Verify running version is patched
bao status -format=json | jq '.version'