OpenBao before version 2.6.3 has an information disclosure flaw that triggers when an attacker sends API requests with malformed plugin parameters such as TypeKVPair or TypeHeader values. The malformed input causes the application to generate error messages that include the attacker‑supplied data, which are then written into the audit logs. As a result, confidential or sensitive information can be recovered by reading those logs.

The vulnerability affects all releases of the OpenBao product prior to 2.6.3. No specific patch versions are listed as mitigated, so any deployment of openbao that has not been upgraded to 2.6.3 or later is potentially vulnerable.

The CVSS score of 2 indicates a low severity impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, where an attacker can submit crafted API requests to the OpenBao application. With remote access, the attacker can harvest the logged sensitive data without needing privileged credentials within the OpenBao system.