CVE-2025-8866
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain …
Published: 2025-08-11 · CVSS: 5.1 · CVSS 4.0
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7