CVE-2025-8415

Published: Aug 20, 2025Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Exploitability: 0.7 / Impact: 5.2

Source: secalert@redhat.com (Secondary)

Description

A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.

Related CWEs

CWE-289

Authentication Bypass by Alternate Name

The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

References (5)

https://access.redhat.com/errata/RHSA-2025:14919

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-8415

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2385773

Source: secalert@redhat.com

https://github.com/cryostatio/cryostat/pull/1001

Source: secalert@redhat.com

https://github.com/cryostatio/cryostat/releases/tag/v4.0.2

Source: secalert@redhat.com

Timeline

No history available yet.