CVE-2025-8415 Details

An authentication bypass vulnerability has been identified in the Cryostat HTTP API, specifically in version 4.0.0. The API binds to all network interfaces, which can expose the API port to external access if Network Policies are disabled. This vulnerability allows an unauthenticated, malicious attacker to send HTTP requests directly to the Cryostat API, bypassing the OpenShift OAuth authentication and authorization mechanisms. The issue arises when the underlying cluster network stack does not support Network Policies, or if the Cryostat installation has been configured to disable them.

Ensure that Network Policies are enabled in the Cryostat Custom Resources and that the underlying cluster network stack supports Network Policies. If Network Policies are disabled, re-enable them or adjust the Cryostat installation to restore the default Network Policy settings.