Medium severity · published Aug 20, 2025
CVE-2025-8415
Cryostat: authentication bypass if network policies are disabled
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Cryostat · Cryostat
before 4.0.2 · source: vendor
C4
Cryostat 4 · Red Hat
All versions, or not specified · source: vendor
C4
Cryostat 4 on RHEL 9 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8415
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8415
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:14919
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-8415
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2385773
github.com
https://github.com/cryostatio/cryostat/pull/1001
github.com
https://github.com/cryostatio/cryostat/releases/tag/v4.0.2