Read the docs
TI-2025-31740 Aliases CVE-2025-49825GHSA-8cqv-pj7f-pwpc

Teleport allows remote authentication bypass

Priority MEDIUM 60CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07924 94th percentileScored 2026-11-07
Fix Fixed github.com/gravitational/teleport (Go): 17.5.2, 16.5.12, 15.5.3 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gravitationalteleportup to 17.5.1; up to 0.0.0-20250616162021-79b2f26125a1—No fix listedCNA
—github.com/gravitational/teleport (Go)17.0.0 to before 17.5.217.5.2Patch availableGHSA-8cqv-pj7f-pwpc
—github.com/gravitational/teleport (Go)16.0.0 to before 16.5.1216.5.12Patch availableGHSA-8cqv-pj7f-pwpc
—github.com/gravitational/teleport (Go)15.0.0 to before 15.5.315.5.3Patch availableGHSA-8cqv-pj7f-pwpc
—github.com/gravitational/teleport (Go)14.0.0 to before 14.4.114.4.1Patch availableGHSA-8cqv-pj7f-pwpc
—github.com/gravitational/teleport (Go)13.0.0 to before 13.4.2713.4.27Patch availableGHSA-8cqv-pj7f-pwpc
—github.com/gravitational/teleport (Go)0.0.11 to before 12.4.3512.4.35Patch availableGHSA-8cqv-pj7f-pwpc
—github.com/gravitational/teleport (Go)up to 0.0.0-20250616162021-79b2f26125a1—No fix listedGHSA-8cqv-pj7f-pwpc
  • teleport Vendorgravitational Affected up to 17.5.1; up to 0.0.0-20250616162021-79b2f26125a1 Fixed in — No fix listed CNA
  • github.com/gravitational/teleport (Go) Vendor— Affected 17.0.0 to before 17.5.2 Fixed in 17.5.2 Patch available GHSA-8cqv-pj7f-pwpc
  • github.com/gravitational/teleport (Go) Vendor— Affected 16.0.0 to before 16.5.12 Fixed in 16.5.12 Patch available GHSA-8cqv-pj7f-pwpc
  • github.com/gravitational/teleport (Go) Vendor— Affected 15.0.0 to before 15.5.3 Fixed in 15.5.3 Patch available GHSA-8cqv-pj7f-pwpc
  • github.com/gravitational/teleport (Go) Vendor— Affected 14.0.0 to before 14.4.1 Fixed in 14.4.1 Patch available GHSA-8cqv-pj7f-pwpc
  • github.com/gravitational/teleport (Go) Vendor— Affected 13.0.0 to before 13.4.27 Fixed in 13.4.27 Patch available GHSA-8cqv-pj7f-pwpc
  • github.com/gravitational/teleport (Go) Vendor— Affected 0.0.11 to before 12.4.35 Fixed in 12.4.35 Patch available GHSA-8cqv-pj7f-pwpc
  • github.com/gravitational/teleport (Go) Vendor— Affected up to 0.0.0-20250616162021-79b2f26125a1 Fixed in — No fix listed GHSA-8cqv-pj7f-pwpc

Remediation

  • Fix · GHSA-8cqv-pj7f-pwpc github.com/gravitational/teleport (Go) Fixed in 17.5.2 Advisory →
  • Fix · GHSA-8cqv-pj7f-pwpc github.com/gravitational/teleport (Go) Fixed in 16.5.12 Advisory →
  • Fix · GHSA-8cqv-pj7f-pwpc github.com/gravitational/teleport (Go) Fixed in 15.5.3 Advisory →
  • Fix · GHSA-8cqv-pj7f-pwpc github.com/gravitational/teleport (Go) Fixed in 14.4.1 Advisory →
  • Fix · GHSA-8cqv-pj7f-pwpc github.com/gravitational/teleport (Go) Fixed in 13.4.27 Advisory →
  • Fix · GHSA-8cqv-pj7f-pwpc github.com/gravitational/teleport (Go) Fixed in 12.4.35 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49825
  2. 2026-10-03 Alias added: GHSA-8cqv-pj7f-pwpc

References

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences