https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:53:51.147322+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-15603 bdu:2025-15603 2026-10-04T08:53:51.268631+00:00 bdu:2025-15603 https://cve.radiocsirt.org/vuln/bit-openbao-2025-62513 BIT-openbao-2025-62513 — OpenBao leaks HTTPRawBody in Audit Logs 2026-10-04T08:53:51.268701+00:00

Affected: Bitnami: openbao

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.

 https://cve.radiocsirt.org/vuln/euvd-2026-256664 EUVD-2026-256664 2026-10-04T08:53:51.268776+00:00 EUVD-2026-256664 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62513 fkie_cve-2025-62513 2026-10-04T08:53:51.268805+00:00

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.

 https://cve.radiocsirt.org/vuln/ghsa-ghfh-fmx4-26h8 GHSA-ghfh-fmx4-26h8 — OpenBao leaks HTTPRawBody in Audit Logs 2026-10-04T08:53:51.268862+00:00

Affected: Go: github.com/openbao/openbao

### Impact

OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacted the following subsystems:

- When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs. - When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs.

Third-party plugins may be affected.

### Patches

OpenBao v2.4.2 will patch this issue.

### Workarounds

If users do not use the above functionality, they are not impacted. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use.

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15663-1 openSUSE-SU-2025:15663-1 — openbao-2.4.3-1.1 on GA media 2026-10-04T08:53:51.268929+00:00

openbao-2.4.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2391 WID-SEC-W-2025-2391 — OpenBao: Mehrere Schwachstellen 2026-10-04T08:53:51.268969+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.