Vulnerability feed

Executive summary

OpenBao versions before 2.6.3 can leak sensitive data into audit logs when a request with malformed plugin parameters is sent to a plugin. The advisory rates the issue Low severity and recommends upgrading to patched versions 2.6.3 or 2.7.0 for OpenBao and 2.6.3 or 2.7.1 for the SDK.

Technical summary

The flaw is an information disclosure issue in which malformed data in fields of type TypeKVPair or TypeHeader causes an error that is written to the audit log, exposing sensitive information. The attacker must be able to send requests to a plugin and holds high privileges according to the CVSS vector (AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 2.0). Affected Go modules are github.com/openbao/openbao/sdk/v2 before 2.6.3 and github.com/openbao/openbao/v2 before 2.6.3; patched versions are 2.6.3 and 2.7.1 for the SDK and 2.6.3 and 2.7.0 for the main module. No workaround is stated. The advisory does not give detection guidance beyond noting the error resembles GHSA-8f5r-8cmq-7fmq, and no CVE ID or CWE is assigned.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/openbao/openbao/security/adv…/GHSA-8xxq-mq9m-xmhw

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

Present

Privileges required

High

User interaction

Passive

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

openbaoopenbaoopenbao SDK pluginsopenbao github.com/openbao/openbao/sdk/v2openbao github.com/openbao/openbao/v2