VULNERABILITY INTELLIGENCE
CVE-2025-8866
EPSS probability0.25%
CISA KEVNot currently listed
Published2025-08-11
Last modified2026-06-17
Description
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.
Weakness classification
- security@yugabyte.com: CWE-200