TI-2026-70753 CVE-2026-108863 · GHSA-54m9-qc5w-93rc
Missing authentication exposes Envoy admin interface in Katanemo Plano
Priority HIGH 77
Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901.