PT-2025-36335 · Onyxia · Onyxia

Ddecrulle · Published 2025-09-05 · Updated 2025-09-08 · CVE-2025-58366

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Onyxia versions 4.6.0 through 4.8.0

Description Onyxia-API leaked credentials of private helm repositories through the public /public/catalogs endpoint. Only instances using private helm repositories with configured usernames and passwords in the catalogs configuration are affected. The issue is fixed in version 4.9.0.

Recommendations Upgrade to version 4.9.0 or later.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-58366

GHSA-M773-6VM8-8X6Q

Affected Products

Onyxia

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58366.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-58366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58366 · Security Note
• https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-m773-6vm8-8x6q · Note
• https://github.com/InseeFrLab/onyxia-api/releases/tag/v4.9.0 · Note
• https://github.com/InseeFrLab/onyxia-api/pull/613 · Note
• https://t.me/canyoupwnme/6918 · Telegram Post
• https://twitter.com/cypmsecnews/status/1964119200386994587 · Twitter Post
• https://twitter.com/CVEnew/status/1964195415471116537 · Twitter Post
• https://t.me/CVEtracker/31829 · Telegram Post
• https://twitter.com/CCBalert/status/1965148723110887563 · Twitter Post