| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/openbao/openbao | < 0.0.0-20251022165510-cc2c476bac66 | 0.0.0-20251022165510-cc2c476bac66 |
| openbao | < 2.4.2 | 2.4.2 |
OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to:
sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log.Third-party plugins may be affected.
This issue has been present since HashiCorp Vault and continues to impact Vault as of v1.20.4.
OpenBao v2.4.2 will patch this issue.
If users do not use the above functionality, they are not impacted. To prohibit the use of sys/raw globally, ensure raw_storage_endpoint=false is set or missing from the server configuration.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free