TI-2025-18876 Aliases CVE-2025-25207 GHSA-r8xr-pgv5-gxw3

Rhcl: authpolicy callbacks result in denial of service in authorino severity

LOW 25CWE-770Published 2025-06-09 · Updated 2026-11-06

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00282 20th percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	rhcl-operator-container	1.0.1	—	No fix listed	CNA
Red Hat	Red Hat Connectivity Link 1	—	—	No fix listed	CNA
Red Hat	Red Hat OpenShift AI (RHOAI)	—	—	No fix listed	CNA
—	github.com/kuadrant/authorino (Go)	up to 0.20.0	—	No fix listed	GHSA-r8xr-pgv5-gxw3

rhcl-operator-container Vendor— Affected 1.0.1 Fixed in — No fix listed CNA
Red Hat Connectivity Link 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
github.com/kuadrant/authorino (Go) Vendor— Affected up to 0.20.0 Fixed in — No fix listed GHSA-r8xr-pgv5-gxw3

CPE names CNA · 2

CPE	Versions	Role	Vendor
cpe:/a:redhat:connectivity_link:1	1	—	Red Hat
cpe:/a:redhat:openshift_ai	—	—	Red Hat

cpe:/a:redhat:connectivity_link:1 Versions 1 — ·Red Hat
cpe:/a:redhat:openshift_ai Versions — — ·Red Hat

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Connectivity Link 1	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-25207
2026-10-03 Alias added: GHSA-r8xr-pgv5-gxw3
2026-11-06 Affected versions changed · CNA
2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-25207

Other 3

TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8

See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences