Yugabyte

Latest CVEs · RSS

• CVE-2026-1966 2026-02-05 · CVSS 2.4
  YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration vi
• CVE-2025-8866 2025-08-11 · CVSS 5.1
  YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit thi
• CVE-2025-8865 2025-08-11 · CVSS 4.1
  The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain malformed inputs. An
• CVE-2025-8864 2025-08-11 · CVSS 6.8
  Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs
• CVE-2025-8863 2025-08-11 · CVSS 7.0
  YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission
• CVE-2025-8862 2025-08-11 · CVSS 7.0
  YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend
• CVE-2024-11193 2024-11-13 · CVSS 5.0
  An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw resu
• CVE-2024-11165 2024-11-13 · CVSS 5.7
  An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversig
• CVE-2024-6908 2024-07-19 · CVSS 6.0
  Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potenti
• CVE-2024-6895 2024-07-19 · CVSS 6.1
  Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical se
• CVE-2024-0006 2024-07-19 · CVSS 5.4
  Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in lo
• CVE-2023-6002 2023-11-07 · CVSS 6.5
  YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forg
• CVE-2023-6001 2023-11-07 · CVSS 5.3
  Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.
• CVE-2023-4640 2023-08-30 · CVSS 6.5
  The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noti
• CVE-2023-0575 2023-02-09 · CVSS 7.2
  External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux
• CVE-2023-0745 2023-02-09 · CVSS 6.7
  The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint
• CVE-2023-0574 2023-02-09 · CVSS 6.8
  Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentica
• CVE-2022-37397 2022-08-12 · CVSS 8.3
  An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticate