CVE-2026-108863 — Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface
Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound t…
Published: 2026-10-11 · CVSS: 8.7 · CVSS 4.0
Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config_dump endpoint to read configured LLM provider API keys in plaintext from the WASM filter configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7