VULNERABILITY INTELLIGENCE
CVE-2025-52893
CVSS score4.5 MEDIUM
EPSS probability0.33%
CISA KEVNot currently listed
Published2025-06-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Description
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.
Weakness classification
- security-advisories@github.com: CWE-532
Primary references
- security-advisories@github.com — Not Applicable
- security-advisories@github.com — Not Applicable
- security-advisories@github.com — Not Applicable
- security-advisories@github.com — Not Applicable
- security-advisories@github.com — Patch
- security-advisories@github.com — Vendor Advisory