CVE - CVE-2025-52893

CVE-ID
CVE-2025-52893	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 URL:https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 MISC:https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a URL:https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a MISC:https://github.com/go-viper/mapstructure/pull/105 URL:https://github.com/go-viper/mapstructure/pull/105 MISC:https://github.com/go-viper/mapstructure/releases/tag/v2.3.0 URL:https://github.com/go-viper/mapstructure/releases/tag/v2.3.0 MISC:https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b30 URL:https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b30 MISC:https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq URL:https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20250620	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250620)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)