Read the docs
TI-2026-84493 Aliases CVE-2026-63482

Missing authentication in Yeti exposes full audit timeline

Priority LOW 39CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Yeti before 2.5.1 registers its audit router without an authentication requirement, so the /api/v2/audit/timeline/{id} endpoint does not check for a logged-in user (CWE-306). An unauthenticated network attacker can query timeline records that include analyst usernames, object identifiers and values, and before-and-after object data. The flaw exposes the operational history of threat intelligence objects.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00429 37th percentileScored 2026-11-07
Fix Fixed yeti (yeti-platform): 2.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yeti-platformyetibefore 2.5.12.5.1Patch availableCNA
  • yeti Vendoryeti-platform Affected before 2.5.1 Fixed in 2.5.1 Patch available CNA

Remediation

Upgrade yeti to version 2.5.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA yeti (yeti-platform) Fixed in 2.5.1

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-63482
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2024-31003 yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the… CVSS 3.1HIGH 7.5
  • TI-2026-62524 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion CVSS 4.0HIGH 7.2
  • TI-2024-31002 A SSTI (server side template injection) vulnerability in the custom template export… CVSS 3.1HIGH 7.3
  • TI-2026-84497 Path traversal in Yeti export task names allows file read and write CVSS 3.1HIGH 8.3
  • TI-2024-30461 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack CVSS 3.1HIGH 7.5
  • TI-2026-84494 AQL injection in Yeti search sorting and filter parameters CVSS 3.1HIGH 7.6
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences