Read the docs
TI-2025-08112 Aliases CVE-2025-8862GHSA-26xv-73mx-mq4r

YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may…

Priority LOW 31CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-201.

Summary

YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00372 31st percentileScored 2026-11-07
Fix Partial YugabyteDB (YugabyteDB Inc): 2024.1.3, 2.20.7.0, 2.23.1.0Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
YugabyteDBYugabyteDB2024.1.0 to before 2024.1.3; 2.20.0.0 to before 2.20.7.0; 2.23.0.0 to before 2.23.1.02024.1.3, 2.20.7.0, 2.23.1.0Patch availableCNA
  • YugabyteDB VendorYugabyteDB Affected 2024.1.0 to before 2024.1.3; 2.20.0.0 to before 2.20.7.0; 2.23.0.0 to before 2.23.1.0 Fixed in 2024.1.3, 2.20.7.0, 2.23.1.0 Patch available CNA

Remediation

  • Fix · CNA YugabyteDB (YugabyteDB Inc) Fixed in 2024.1.3, 2.20.7.0, 2.23.1.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    YugabyteDB 2.20.7.0, 2.23.1.0, 2024.1.3

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-08113 YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmissionPriority LOW 30
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8862
  2. 2026-10-03 Alias added: GHSA-26xv-73mx-mq4r

References

Other 1

  • TI-2024-27623 YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter. CVSS 3.1HIGH 7.5
  • TI-2023-00545 Remote code execution in YugabyteDB CVSS 3.1CRITICAL 9.8
  • TI-2022-17471 The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory CVSS 3.1CRITICAL 9.8
  • TI-2023-00707 Arbitrary File Write in High Availability Backup Upload CVSS 3.1CRITICAL 9.8
  • TI-2023-00544 Server-side request forgery in YugabyteDB Anywhere CVSS 3.1CRITICAL 9.8
  • TI-2023-05529 Prometheus Metrics Accessible Pre-Authentication CVSS 3.1HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences