CVE-2025-62513: 
NixOS vulnerability analysis and mitigation

CVE-2025-62513 is an audit log information disclosure vulnerability in OpenBao, an open-source secrets management system, wherein raw HTTP bodies for certain endpoints were not correctly redacted (HMAC'd) due to a regression. It affects OpenBao versions 2.2.0 through 2.4.1 and was disclosed on October 22, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.7 (Medium) (GitHub Advisory, OpenBao Advisory).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File). When the audit subsystem cloned the to-be-logged structure, it walked the original copy while modifying the clone; because HTTPRawBody is of type []byte, it was not correctly HMAC'd during this process, leaving plaintext sensitive data in audit logs (OpenBao Commit). Two subsystems are specifically impacted: the ACME functionality of the PKI engine (leaking short-lived ACME verification challenge codes) and the OIDC issuer functionality of the identity subsystem (leaking auth/token response codes and claims). Third-party plugins that rely on raw HTTP body logging may also be affected (OpenBao Advisory).

An attacker with access to OpenBao audit logs can read sensitive data that should have been redacted, including ACME verification challenge codes and OIDC authentication tokens, token response codes, and identity claims. While ACME verification codes expire after challenge completion and are of limited long-term utility, OIDC tokens and claims represent a more significant confidentiality risk, potentially enabling session hijacking or unauthorized access to downstream systems. There is no integrity or availability impact; the vulnerability is purely a confidentiality concern (GitHub Advisory, OpenBao Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047% (15th percentile), indicating a low near-term exploitation probability. Exploitation requires an attacker to already have access to OpenBao audit logs, which significantly limits the attack surface.

• Logs: OpenBao audit log entries containing plaintext (non-HMAC'd) HTTPRawBody fields for ACME PKI or OIDC identity endpoints — look for raw JSON bodies with fields such as token, code, id_token, or ACME challenge response values appearing unredacted rather than as HMAC digests.
• File System: Unexpected access or exfiltration of OpenBao audit log files (e.g., unusual read activity on audit log paths by non-administrative accounts or processes).
• Network: Anomalous outbound connections from systems with audit log access, potentially indicating log exfiltration following unauthorized log access.

Upgrade to OpenBao version 2.4.2, which contains the fix refactoring audit log formatting to correctly HMAC HTTPRawBody fields (OpenBao Commit, OpenBao Advisory). As a workaround for those unable to upgrade immediately, organizations not using ACME PKI or OIDC issuer functionality are not impacted and need not take action. For those using these features, restrict access to audit log files using strict file permissions, temporarily disable the affected subsystems (ACME, OIDC), review recent audit logs for potential sensitive data exposure, and rotate any potentially compromised OIDC tokens or credentials.

The advisory was published by OpenBao maintainer cipherboy on October 22, 2025, and the fix was co-authored with contributor wslabosz-reply (OpenBao Commit). The vulnerability received coverage from Linux security news outlets and distribution security advisories for Fedora 41, 42, and 43, reflecting the package's inclusion in major Linux distributions (GitHub Advisory). No significant social media controversy or broad industry commentary has been observed beyond routine vulnerability tracking.