PT-2025-24401 · Red Hat · Red Hat Connectivity Link

Published 2025-06-09 · Updated 2025-06-09 · CVE-2025-25209

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Red Hat Connectivity Link (affected versions not specified)

Description The issue concerns the AuthPolicy metadata in Red Hat Connectivity Link, which contains an object storing secrets. However, it assumes these secrets are already in the kuadrant-system instead of copying them to the referred namespace. This creates an opportunity for a malicious actor with developer persona access to leak those secrets over an HTTP connection, provided the attacker knows the name of the targeted secrets and those secrets are limited to one line only.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-25209

Affected Products

Red Hat Connectivity Link

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-25209 · Security Note
• https://twitter.com/VulmonFeeds/status/1931980446285312051 · Twitter Post
• https://t.me/cvetracker/25747 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2347438 · Note
• https://access.redhat.com/security/cve/CVE-2025-25209 · Note
• https://t.me/cvenotify/125040 · Telegram Post
• https://twitter.com/CVEnew/status/1931967865886023835 · Twitter Post