PT-2025-49315 · Google · Google Apigee+1

Nikita Markevich

·

Published

2025-12-05

·

Updated

2025-12-06

·

CVE-2025-13426

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Name of the Vulnerable Software and Affected Versions Google Apigee versions prior to Hybrid 1.11.2 Google Apigee versions prior to Hybrid 1.12.4 Google Apigee versions prior to Hybrid 1.13.3 Google Apigee versions prior to Hybrid 1.14.1 Google Apigee versions prior to OPDK 5202 Google Apigee versions prior to OPDK 5300
Description A security issue exists in the JavaCallout policy within Google Apigee. This allows for remote code execution by enabling a user to inject a malicious object into the MessageContext. This can lead to the execution of arbitrary Java code and system commands at runtime, potentially resulting in unauthorized data access and network lateral movement. The vulnerable component is the JavaCallout policy, accessible via the API endpoint https://docs.apigee.com/api-platform/reference/policies/java-callout-policy. The MessageContext is a vulnerable parameter.
Recommendations Update to Google Apigee Hybrid version 1.11.2 or later. Update to Google Apigee Hybrid version 1.12.4 or later. Update to Google Apigee Hybrid version 1.13.3 or later. Update to Google Apigee Hybrid version 1.14.1 or later. Update to Google Apigee OPDK version 5202 or later. Update to Google Apigee OPDK version 5300 or later.

Fix

RCE

Weakness Enumeration

CWE-913

Related Identifiers

CVE-2025-13426

Affected Products

Google Apigee
Opdk