PT-2025-51263 · Edb+1 · Hybrid Manager - Lts+3

Published 2025-12-15 · Updated 2026-02-18 · CVE-2025-14038

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions EDB Hybrid Manager versions prior to 1.3.3 EDB Hybrid Manager - Innovation versions prior to 2025.12 EDB Hybrid Manager - LTS versions prior to 1.3.3

Description EDB Hybrid Manager has a flaw that allows an unauthenticated attacker to access certain gRPC endpoints directly. This access could allow an attacker to read sensitive data or potentially cause a denial-of-service by sending malformed data to these endpoints. The issue stems from a misconfiguration in the Istio Gateway, which manages authentication and authorization for the affected endpoints. The security policy relies on explicitly defined permissions in the Istio Gateway configuration, but the affected endpoints were not defined, allowing requests to bypass authentication and authorization. The vulnerable endpoints are gRPC endpoints, and access to them does not require authentication.

Recommendations EDB Hybrid Manager versions prior to 1.3.3 should be upgraded to version 1.3.3. EDB Hybrid Manager - Innovation versions prior to 2025.12 should be upgraded to version 2025.12. EDB Hybrid Manager - LTS versions prior to 1.3.3 should be upgraded to version 1.3.3.

Fix

DoS

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

Related Identifiers

CVE-2025-14038

Affected Products

Edb Hybrid Manager

Hybrid Manager - Innovation

Hybrid Manager - Lts

Istio Gateway

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14038 · Security Note
• https://enterprisedb.com/docs/security/advisories/cve202514038 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14038 · Vendor Advisory
• https://twitter.com/CVEnew/status/2002857387624165886 · Twitter Post
• https://t.me/CVEtracker/39859 · Telegram Post
• https://t.me/cveNotify/152358 · Telegram Post