Detections
Analytics

SCA: security update for github.com/openbao/openbao/sdk/v2 (GHSA-8f5r-8cmq-7fmq)

medium Tenable Cloud Security Plugin ID 428665

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including
 secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when
 processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has
 been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to
 ensure properly formatted requests from all clients. (CVE-2025-52893)

See Also

https://github.com/advisories/GHSA-8f5r-8cmq-7fmq

Plugin Details

Severity: Medium

ID: 428665

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 7/29/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:N/A:N

CVSS Score Source: CVE-2025-52893

CVSS v3

Risk Factor: Medium

Base Score: 4.5

Temporal Score: 3.9

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/26/2025

Vulnerability Publication Date: 6/25/2025

Reference Information

CVE: CVE-2025-52893

cwe: CWE-532