Is there a patch available for CVE-2025-62705?

Yes, a patch is available for CVE-2025-62705. Update the affected software to the latest version immediately.

OpenBao CVE-2025-62705

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:45 vuln.today

DescriptionCVE.org

Alpine Linux: openbao fixed in 2.4.3-r0

AnalysisAI

OpenBao, the open-source secrets management fork of HashiCorp Vault, received a security fix in Alpine Linux package version 2.4.3-r0. The nature of the underlying vulnerability is not disclosed in available intelligence sources - no CVE description, CVSS vector, or CWE has been published. With an EPSS score of 0.05% (16th percentile), exploitation probability is very low at time of analysis, and no public exploit or CISA KEV listing exists.

Technical ContextAI

OpenBao is an open-source fork of HashiCorp Vault maintained by the Linux Foundation, designed for secrets management, encryption-as-a-service, and privileged access control. The fix was delivered as Alpine Linux package version 2.4.3-r0. No CWE classification is available, making it impossible to characterize the root cause class (e.g., injection, memory corruption, access control bypass). No CPE string was provided; the affected component is inferred to be the openbao Alpine Linux package prior to 2.4.3-r0.

Affected ProductsAI

OpenBao versions prior to 2.4.3-r0 as packaged in Alpine Linux are confirmed affected per the vendor (Alpine) advisory. The exact upstream OpenBao version corresponding to Alpine package 2.4.3-r0 is not confirmed in available data. No CPE string was provided. Other Linux distributions packaging OpenBao may be independently affected but are not addressed in this advisory.

RemediationAI

Upgrade the Alpine Linux openbao package to version 2.4.3-r0 or later using the standard Alpine package manager: 'apk upgrade openbao'. This is the only confirmed fix identified at time of analysis. No upstream OpenBao release version is independently confirmed from available data; administrators running OpenBao outside Alpine Linux should consult the OpenBao project's own security advisories and GitHub releases to determine the corresponding patched upstream version. No workarounds or compensating controls are documented because the vulnerability's nature (attack vector, affected component, exploitation mechanism) is unknown.