PT-2025-36994 · Infrahub · Infrahub

Fatih-Acar · Published 2025-09-09 · Updated 2025-09-10 · CVE-2025-59036

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Infrahub versions prior to 1.3.9 Infrahub versions prior to 1.4.5

Description: Infrahub provides a central hub for managing data, templates, and playbooks. A flaw in the authentication logic allows deleted or expired API tokens to be considered valid, enabling authentication with any API token associated with an active user account.

Recommendations: For versions prior to 1.3.9, delete or deactivate the account associated with a deleted API token to prevent authentication. For versions prior to 1.4.5, delete or deactivate the account associated with a deleted API token to prevent authentication.

Exploit

Fix

Weakness Enumeration

CWE-298

Related Identifiers

CVE-2025-59036

GHSA-V2P7-4PV4-3WWH

Affected Products

Infrahub

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59036.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59036 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59036 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v2p7-4pv4-3wwh · Vendor Advisory
• https://github.com/opsmill/infrahub/security/advisories/GHSA-v2p7-4pv4-3wwh · Note
• https://github.com/opsmill/infrahub/commit/61b49a4a9e988f10c3a44f0e86ef97f344a1e228 · Note
• https://github.com/opsmill/infrahub · Note
• https://github.com/opsmill/infrahub/commit/215185f217e2f754f7c0a0aa4b77e11079a063a1 · Note
• https://github.com/opsmill/infrahub/releases/tag/infrahub-v1.4.5 · Note
• https://github.com/opsmill/infrahub/releases/tag/infrahub-v1.3.9 · Note
• https://twitter.com/CVEnew/status/1965557677158777256 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1965617616174665756 · Twitter Post