CVE Daily

CVE-2025-8866

YugabyteDB Anywhere web server does not properly enforce authentication for the ...

Medium CVSS 5.1

Overview

YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.

CWE: CWE-200 Published: 2025-08-11T17:15:27.557
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 5.1 (MEDIUM)
  • Detected tags: unauth_access (tag impact: HIGH)

Recommended actions:

  • Enforce authentication/authorization; reduce default endpoint exposure.

Recommended tools

Tags