Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2025-8866

YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain ser

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Yugabyte

Description

YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

YugabyteDB Inc YugabyteDB Anywhere

Default version status: unaffected

  • 2025.*unaffected
  • 2024.*affected
  • 2.20.*affected

References