PT-2025-34113 · Cryostat · Cryostat

Published 2025-08-20 · Updated 2025-12-23 · CVE-2025-8415

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Cryostat HTTP API (affected versions not specified)

Description: Cryostat’s HTTP API binds to all network interfaces, potentially allowing external visibility and access to the API port if Network Policies are disabled. This could allow an unauthenticated, malicious attacker to compromise the environment.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-289

Related Identifiers

CVE-2025-8415

Affected Products

Cryostat

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-8415 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8415 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:14919 · Vendor Advisory
• https://github.com/cryostatio/cryostat/releases/tag/v4.0.2 · Note
• https://github.com/cryostatio/cryostat/pull/1001 · Note
• https://t.me/cveNotify/146720 · Telegram Post
• https://twitter.com/CVEnew/status/1958211957368160619 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2385773 · Note
• https://t.me/CVEtracker/30503 · Telegram Post
• https://t.me/cveNotify/134152 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2025-8415 · Note