The vulnerability is a case of sensitive information being inserted into log files. The root cause is not within the OpenBao codebase itself, but in a third-party dependency, github.com/go-viper/mapstructure. This library is used to decode configuration or request data into Go structs.

The analysis of the provided patch commit ed3f92181528ff776a0324107b8b55026e93766a reveals that the error message generation functions within mapstructure were modified to remove the actual data value from the error strings.

Specifically, the Error() methods for UnconvertibleTypeError and ParseError structs were changed to no longer include the e.Value field in the formatted error string. The log message provided in the vulnerability description (error converting input for field "password": ... value: '<sensitive data>') directly corresponds to the output of the old (*UnconvertibleTypeError).Error function.

When an application like OpenBao receives a request with malformed data for a sensitive field (e.g., a JSON object for a password that should be a string), it uses mapstructure to process this data. mapstructure would fail and generate a detailed error message containing the malformed, sensitive data. This error would then be caught and logged by OpenBao, leading to the information leak. The identified functions are the precise source of the error messages that contain the sensitive data.