If you use kanidim-provision to help with user, group, or oauth2 provisioning via kanidm, there’s an important CVE you need to know about. CVE-2025-30205 uncovers a security vulnerability that could leak your admin credentials straight into your system logs—an unintentional and dangerous side effect caused by faulty debug instrumentation.

In this post, we’ll break down what happened, show you how it happens (with code), explain if you’re affected, and show you how to fix it.

What Is CVE-2025-30205?

CVE-2025-30205 is a vulnerability found in the optional kanidm patches shipped with kanidim-provision prior to version 1.2.. When provisioning admin accounts like admin or idm_admin, these patches could leak your credentials into the system log because of a buggy function instrumentation.

TL;DR: If you use kanidim-provision’s patches to provision admin accounts—and you haven’t turned the log verbosity down—your admin passwords are probably in your logs.

Let’s take a simplified look at what the broken code might have done

// In the instrumented provisioning function
#[instrument]
pub fn provision_admin(admin_username: &str, admin_password: &str) -> Result<(), Error> {
    // ... provisioning logic ...
}

The Rust #[instrument] macro from the tracing crate automatically logs the function parameters at the current log level—by default, info. So, every time this function runs, both admin_username and admin_password could be logged:

INFO  provision_admin{admin_username="admin", admin_password="SuperSecret123"}: called

This is exactly what you DON'T want for sensitive data. Unfortunately, unless you tweak the macro or log level, this leaks secrets by design.

How to Exploit (Theoretical Example)

There isn’t a remote exploit for this; rather, it’s a post-exploitation or insider data leak vector: anyone with access to the system logs will see the plaintext credentials.

1. An attacker with access to system logs runs

sudo cat /var/log/syslog | grep 'provision_admin'

2. They find entries like

INFO  provision_admin{admin_username="admin", admin_password="SuperSecret123"}: called

3. Admin password is compromised.

This shows how accidental instrumentation leaks defenses.

The Fix

The kanidim-provision maintainers fixed this in tag v1.2. by patching the instrumentation so sensitive parameters are no longer logged.

How to patch

1. Update kanidm patches: Download patchset/tag v1.2. or higher.
2. Recompile kanidm with the latest patches applied. (Follow the official guide)

Workaround

If you can’t update right away, set the environment variable KANIDM_LOG_LEVEL to a stricter level:

export KANIDM_LOG_LEVEL=warn

Or in your service config

[Service]
Environment="KANIDM_LOG_LEVEL=warn"

This suppresses info log entries, so call arguments (including admin_password) aren’t recorded.

References

- Original Advisory - kanidim-provision changelog
- Kanidm Documentation
- Kanidm Security Issues
- tracing Instrumentation in Rust

Final Thoughts

CVE-2025-30205 is a great example of how a desire to make debugging easier can accidentally expose your crown jewels. Always carefully review what gets logged, especially in security-sensitive code. Apply the latest patch, rotate your credentials, and review your logs if you think you’re at risk.

Stay safe, and keep those secrets off the logs!

*Written exclusively for StackSecurity News | June 2024 — Please share responsibly!*

Timeline

Published on: 03/24/2025 17:15:21 UTC
Last modified on: 03/27/2025 16:45:46 UTC