VulnerabilityDeferred

CVE-2025-49825

Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass.

CRITICAL 9.8EPSS 7.97%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (7.97%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 7.97% probability · 94th percentile
CISA KEV: Not listed
Weakness: CWE-863
Source: security-advisories@github.com

References

https://github.com/gravitational/teleport/security/advisories/GHSA-8cqv-pj7f-pwpc

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.