CVE-2026-108863 Details

A missing authentication vulnerability has been identified in Katanemo Plano versions through 0.4.37. This vulnerability allows unauthenticated network attackers to access the Envoy admin interface, which is exposed on all host interfaces via port 9901. Once accessed, attackers can request the '/config_dump' endpoint, which reveals configured LLM provider API keys in plaintext from the WASM filter configuration. The vulnerability arises because the admin interface lacks authentication and is bound to all network interfaces, making it accessible to any network caller with reach to the host on the specified port.

The Katanemo Plano admin interface should be bound to '127.0.0.1' and not published to the host by default. Remove the '19901:9901' port publication from the 'docker_start_plano_detached' function and the development Compose file. For immediate access needs, operators can manually bind the admin port to loopback and use an SSH tunnel.