PT-2025-32557 · Yugabyte · Yugabytedb Anywhere

Published 2025-08-11 · Updated 2025-08-12 · CVE-2025-8866

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/U:Clear

Name of the Vulnerable Software and Affected Versions: YugabyteDB Anywhere (affected versions not specified)

Description: The YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-8866

Affected Products

Yugabytedb Anywhere

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8866 · Security Note
• https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy · Note
• https://twitter.com/CVEnew/status/1954948968162500614 · Twitter Post
• https://t.me/cveNotify/131696 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1954960852882272391 · Twitter Post
• https://t.me/CVEtracker/29694 · Telegram Post
• https://twitter.com/MxScripter/status/1955131663480144203 · Twitter Post
• https://twitter.com/MxScripter/status/1955131660376346880 · Twitter Post