Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2025-13426

Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GoogleCloud

Description

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Google Cloud Apigee hybrid Javacallout policy

Default version status: unaffected

  • 0 to < Hybrid_1.11.2affected
  • 0 to < Hybrid_1.12.4affected
  • 0 to < Hybrid_1.13.3affected
  • 0 to < Hybrid_1.14.1affected
  • 0 to < OPDK_5202affected
  • 0 to < OPDK_5300affected

References