Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: openbao fixed in 2.4.3-r0
AnalysisAI
OpenBao, an open-source secrets management platform and Linux Foundation-maintained fork of HashiCorp Vault, received a security fix in Alpine Linux package version 2.4.3-r0 addressing CVE-2025-62513. The vulnerability details, attack vector, and impact class are not disclosed in available intelligence, making precise characterization of attacker capability impossible at this time. EPSS scoring of 0.05% (16th percentile) indicates very low observed exploitation probability, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
OpenBao is a community-driven, open-source fork of HashiCorp Vault, designed for secrets management, encryption-as-a-service, and privileged access management in cloud-native and on-premises environments. It is distributed as an Alpine Linux package under the name 'openbao'. The fix is carried in Alpine package version 2.4.3-r0, suggesting the upstream OpenBao release is version 2.4.3. No CWE is assigned in available data, so the root cause class - whether memory corruption, injection, improper access control, cryptographic weakness, or another category - cannot be determined from current intelligence. No CPE strings were provided to further scope affected products or configurations.
Affected ProductsAI
The affected product is OpenBao as distributed via Alpine Linux. The fix is confirmed present in Alpine package version 2.4.3-r0, indicating that Alpine packages prior to 2.4.3-r0 are vulnerable. The corresponding upstream OpenBao version is inferred to be 2.4.3 or later for the fix. Whether other Linux distributions or the upstream OpenBao project binary releases are independently affected is not confirmed by available data. No CPE strings were provided. The sole reporting source is the Alpine Linux vendor security feed.
RemediationAI
Upgrade the openbao Alpine Linux package to version 2.4.3-r0 or later using the standard Alpine package manager: 'apk update && apk upgrade openbao'. This is the only confirmed remediation action derivable from available data. No upstream vendor advisory URL, no CVSSv3 vector, and no CWE are available to inform additional compensating controls. Organizations unable to patch immediately should consider restricting network access to OpenBao listeners, enforcing strict audit logging on all secret access operations, and reviewing active tokens and leases for anomalies - standard hardening for secrets management infrastructure. These mitigations do not substitute for patching, as the specific vulnerability class is unknown. Users on non-Alpine distributions should monitor the upstream OpenBao project releases and security advisories for corresponding guidance.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today