# CVE-2025-62513: GO-2025-4049 - OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao

Source: https://junglewise.ai/threats/cve-2025-62513-openbao-leaks-httprawbody-in-audit-logs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-22  
License: CC BY 4.0 with a link back

CVE-2025-62513 · Severity: high · CVSS 7.5 · Published 2025-10-22

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.

Technologies: [github.com/openbao/openbao (Go)](https://junglewise.ai/threats/technologies/github-com-openbao-openbao), [OpenBao](https://junglewise.ai/threats/technologies/openbao). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenBao](https://junglewise.ai/threats/vendors/openbao).

## Quick answers

**Is CVE-2025-62513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62513 being exploited in the wild.

**How severe is CVE-2025-62513?** High severity, with a CVSS score of 7.5, published 22 October 2025.

**Which products and versions are affected?** github.com/openbao/openbao (Go) SEMVER:introduced=0.0.0-20241114205727-b1235e585db7,fixed=0.0.0-20251022165510-cc2c476bac66.

**Is there a fix for CVE-2025-62513?** Yes. github.com/openbao/openbao (Go): upgrade to 0.0.0-20251022165510-cc2c476bac66 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-62513?** Check whether you run github.com/openbao/openbao (Go) or OpenBao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openbao/openbao (Go): upgrade to 0.0.0-20251022165510-cc2c476bac66 or later

  ```sh
  go get github.com/openbao/openbao@v0.0.0-20251022165510-cc2c476bac66
  ```


## Affected products

- github.com/openbao/openbao (Go) SEMVER:introduced=0.0.0-20241114205727-b1235e585db7,fixed=0.0.0-20251022165510-cc2c476bac66
- OpenBao

## Identifiers

- CVE-2025-62513
- GHSA-ghfh-fmx4-26h8
- GO-2025-4049

## Related threats

- [OpenBao policy cache incorrect authorization via namespace traversal](https://junglewise.ai/threats/cve-2026-115365-openbao-from-2-3-0-before-2-6-3-contains-an-incorrect)
- [OpenBao ACL bypass in policy denial evaluation](https://junglewise.ai/threats/cve-2026-115361-openbao-before-2-6-3-contains-an-acl-bypass-vulnerability-that)
- [OpenBao Kubernetes Auth token renewal on revoked credentials](https://junglewise.ai/threats/cve-2026-115356-openbao-before-2-6-4-and-2-7-x-before-2-7-1-does-not-verify-when)
- [OpenBao Agent information disclosure via stdout in exec rendering mode](https://junglewise.ai/threats/cve-2026-77285-openbao-agent-information-disclosure-via-stdout-in-exec-rendering)
- [OpenBao recovery mode timing attack token leakage](https://junglewise.ai/threats/cve-2026-63132-openbao-recovery-mode-timing-attack-token-leakage)