Cryostat: authentication bypass if network policies are disabled
Priority LOW 28CWE-289Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Partial Cryostat (Cryostat): 4.0.2Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cryostat | Cryostat | before 4.0.2 | 4.0.2 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 0.5.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 on RHEL 9 | — | 4.0.2-3 | Patch available | CNA |
| Red Hat | Cryostat 4 | — | — | No fix listed | CNA |
| Red Hat | Cryostat 4 | — | — | No fix listed | CNA |
| Red Hat | Cryostat 4 | — | — | No fix listed | CNA |
- Cryostat VendorCryostat Affected before 4.0.2 Fixed in 4.0.2 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 0.5.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 on RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-3 Patch available CNA
- Cryostat 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Cryostat 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Cryostat 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
Remediation
- Fix · CNA Cryostat (Cryostat) Fixed in 4.0.2
Red Hat 1 advisory
- RHSA-2025:14919 Released 2025-09-03 · Red Hat rating ImportantRed Hat build of Cryostat 4.0.2: new RHEL 9 container image security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-db-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2025:14919 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8415
- 2026-10-03 Alias added: GHSA-h2p8-37qr-qfr9
References
Sources
- CVE-2025-8415 · CVE Program
- CVE-2025-8415 · NVD
- FIRST EPSS
- GHSA-h2p8-37qr-qfr9 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-8415 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences