CVE-2025-8866 — YugabyteDB Inc / YugabyteDB Anywhere

CVE-2025-8866

YugabyteDB Inc / YugabyteDB Anywhere PUBLISHED

Description (CNA)

YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.

Affected (CNA)

Vendor / product	Versions
YugabyteDB Inc / YugabyteDB Anywhere	unaffected 2025.; affected 2024.; affected 2.20.*

CWE

CWE-200

References

https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.