EDB Hybrid Manager CVE-2025-14038

Exploitation requires network reachability to Hybrid Manager gRPC endpoints that were omitted from the Istio Gateway's authorization policy definition; no credentials are needed (PR:N). The limiting factor is that only the specific undefined endpoints are affected - endpoints correctly declared in the Istio configuration remain protected - and the vendor's AC:H suggests the attacker must reach the internal gRPC service and target the particular unprotected endpoints rather than any public URL. Affected deployments are all versions of Hybrid Manager LTS (fixed in 1.3.3) and Innovation (fixed in 2025.12); patched instances are not exploitable.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) scores 7.0 (High): network-reachable and fully unauthenticated (PR:N), which aligns with the CWE-306 Missing Authentication root cause, but the vendor assigned AC:H, implying exploitation is not entirely trivial (e.g., requiring knowledge of or network reach to the specific undefined gRPC endpoints behind the Istio mesh). Impact is asymmetric: confidentiality and integrity are only Low (C:L/I:L - reading 'potentially sensitive data' and writing malformed data), but availability is High (A:H - DoS by malformed writes). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or widespread exploitation; the threat signal rests entirely on the theoretical vector. The AC:H rating is notably in tension with a plain unauthenticated-endpoint-access flaw, which would typically be AC:L - verify the exact reachability prerequisite with EnterpriseDB. Overall: patch promptly for exposed deployments, but absent EPSS/KEV/POC data this is a prioritize-in-normal-cycle issue, not a drop-everything one.

An attacker with network access to a Hybrid Manager deployment sends requests directly to gRPC endpoints that were never registered in the Istio Gateway's authorization policy, bypassing both authentication and authorization. They retrieve potentially sensitive data from the service, or write malformed payloads to trigger a denial-of-service. No public exploit code was identified in the provided data, and the vendor's AC:H rating suggests non-trivial reachability or endpoint knowledge is needed.