Katanemo Plano versions up to 0.4.37 expose the Envoy admin interface without authentication, allowing unauthenticated network attackers to hit the /config_dump endpoint. The response includes the full WASM filter configuration, revealing LLM provider API keys in plain text. This constitutes a confidentiality breach and could facilitate further compromise if those keys are exploited.

The vulnerability affects Katanemo’s Plano software through version 0.4.37 (and earlier releases). Any instance running a vulnerable version and exposing the Envoy admin port (9901) is at risk.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, but the flaw is exploitable by any attacker who can reach port 9901, as the admin interface is bound to all host interfaces. The vulnerability is not listed in the CISA KEV catalog, but the exposed credentials present a clear opportunity for attackers to retrieve sensitive API keys. The attack vector is straightforward: a remote attacker can send a request over the network to the exposed admin endpoint without authentication requirements.