CVE-2025-8415

MEDIUM

Cryostat < 4.0.2 - Unauthenticated Authentication Bypass via HTTP API

Title source: llm
STIX 2.1

Description

A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.

References (5)

Core 5
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:14919
Vendor Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2025-8415
Issue Tracking issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2385773

Scores

CVSS v3 5.9
EPSS 0.0005
EPSS Percentile 16.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-289
Status published
Products (4)
Cryostat/Cryostat < 4.0.2
Red Hat/Cryostat 4
Red Hat/Cryostat 4 on RHEL 9 0.5.2-3
Red Hat/Cryostat 4 on RHEL 9 4.0.2-3
Published Aug 20, 2025
Tracked Since Feb 18, 2026