CVE-2025-62705: OpenBao and Vault Leak []byte Fields in Audit Logs

OpenBao’s audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to:

• sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log.
• Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log.

Third-party plugins may be affected.

This issue has been present since HashiCorp Vault and continues to impact Vault as of v1.20.4.