CVE-2025-62513— OpenBao leaks HTTPRawBody in Audit Logs
Quick assessment
Affected
openbao openbao
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenBao是OpenBao开源的一个敏感数据管理软件。 OpenBao 2.2.0版本至2.4.1版本存在日志信息泄露漏洞，该漏洞源于审计日志未正确编辑原始HTTP主体，可能导致ACME验证码和OIDC响应代码泄露。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-62513
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenBao leaks HTTPRawBody in Audit Logs
Source: CVE Program / CVE List V5
Vulnerability Description
OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
OpenBao 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenBao是OpenBao开源的一个敏感数据管理软件。 OpenBao 2.2.0版本至2.4.1版本存在日志信息泄露漏洞，该漏洞源于审计日志未正确编辑原始HTTP主体，可能导致ACME验证码和OIDC响应代码泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-62513
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-62513
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: openbao
-
CVE-2026-63132
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timi -
CVE-2026-63131
OpenBao LIST ACL bypass: a trailing-slash LIST request skips -
CVE-2026-77285
OpenBao Agent Writes Secrets to Stdout -
CVE-2026-71543
OpenBao's Templated Policies Allow Privilege Escalation via -
CVE-2026-55770
OpenBao: LDAPi ldaputil (wrong escape func)
Same vendor: openbao
-
CVE-2026-63132
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timi -
CVE-2026-63131
OpenBao LIST ACL bypass: a trailing-slash LIST request skips -
CVE-2026-77285
OpenBao Agent Writes Secrets to Stdout -
CVE-2026-71543
OpenBao's Templated Policies Allow Privilege Escalation via -
CVE-2026-55770
OpenBao: LDAPi ldaputil (wrong escape func)
Same weakness: CWE-532
-
CVE-2026-94593
Armatura LLC Armatura One Insertion of Sensitive Information -
CVE-2026-94594
Armatura LLC Armatura One Insertion of Sensitive Information -
CVE-2026-104055
Monitoring-user password logged in cleartext by postgres_exp -
CVE-2026-104872
Multiple @opentelemetry/instrumentation-* packages expose da -
CVE-2026-78242
Apache APISIX: data-mask may fail to redact request headers
V. Comments for CVE-2025-62513
No comments yet