Comment Comment by cipherboy Since HashiCorp and OP did not opt to disclose to OpenBao, the most authoritative source right now is HashiCorp's security tracker, linked down-thread: https://news.ycombinator.com/item?id=44821779https://discuss.hashicorp.com/tag/security-vault is the aggregate link, with HCSEC-2025-[13..22] being the relevant topics.I will be working shortly to acquire additional CVE numbers for OpenBao for the 8 affected issues.HCSEC-2025-18 / CVE-2025-6037 (core user confusion bug) does not affect OpenBao.In general, our release notes detail fixed security issues: https://openbao.org/docs/release-notes/2-3-0/ per policy https://github.com/openbao/.github/blob/main/SECURITY.md. This also has contact information if anyone wishes to discuss additional new security issues. parent cipherboy 1 year ago
https://discuss.hashicorp.com/tag/security-vault is the aggregate link, with HCSEC-2025-[13..22] being the relevant topics.
I will be working shortly to acquire additional CVE numbers for OpenBao for the 8 affected issues.
HCSEC-2025-18 / CVE-2025-6037 (core user confusion bug) does not affect OpenBao.
In general, our release notes detail fixed security issues: https://openbao.org/docs/release-notes/2-3-0/ per policy https://github.com/openbao/.github/blob/main/SECURITY.md. This also has contact information if anyone wishes to discuss additional new security issues.