A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00037.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Redhat
  • Cryostat

No data.

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-25390 A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.
Fixes

Solution

No solution given by the vendor.

Workaround

Cryostat is not vulnerable by default, as Network Policy is enabled and prevents this behavior. Make sure the Network Policies are enabled in Custom Resources and that the underlying cluster network stack supports Network Policies.

References
Link Providers
https://access.redhat.com/errata/RHSA-2025:14919 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2025-8415 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2385773 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-8415 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-8415 cve-icon
History

Wed, 03 Sep 2025 03:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:cryostat:4::el9
References

Thu, 21 Aug 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 20 Aug 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 20 Aug 2025 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.
Title Cryostat: authentication bypass if network policies are disabled
First Time appeared Redhat
Redhat cryostat
Weaknesses CWE-289
CPEs cpe:/a:redhat:cryostat:4
Vendors & Products Redhat
Redhat cryostat
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2025-09-03T03:05:41.550Z

Reserved: 2025-07-31T13:42:35.044Z

Link: CVE-2025-8415

cve-icon Vulnrichment

Updated: 2025-08-20T18:38:09.247Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-08-20T17:15:37.953

Modified: 2025-09-03T04:16:06.033

Link: CVE-2025-8415

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-08-20T00:00:00Z

Links: CVE-2025-8415 - Bugzilla

cve-icon OpenCVE Enrichment

No data.