YAOOK Operator CVE-2025-14758

Exploitation requires that the infra-operator's MariaDB replication channel is deployed with its incorrect/insecure replication security configuration (CWE-1188 insecure default initialization), such that replication traffic is not adequately encrypted or authenticated. The attacker must hold an on-path (adjacent-network, AV:A) position able to intercept traffic between MariaDB replication peers - this is the primary limiting factor and excludes purely remote internet-based attackers. No database authentication or user interaction is needed (PR:N/UI:N), but the attack is confined to read-only disclosure of data in transit and depends on the vulnerable replication configuration being in use.

This is a genuine but moderate-severity information-disclosure issue, not a top-priority emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: an 'on-path' attacker aligns with AV:A (adjacent/positioned on the network path) rather than AV:N, and C:H with I:N/A:N matches a read-only disclosure of replication traffic including possible credentials. The EPSS score is very low (0.18%, 7th percentile), there is no CISA KEV listing, and no public exploit is identified, so there is no evidence of active or widespread exploitation - consistent with a flaw whose exploitation requires privileged network positioning between MariaDB replication peers rather than internet-wide reachability. The key limiting factor is the AV:A requirement: an attacker must already be able to intercept intra-cluster replication traffic, which substantially narrows realistic exploitation to compromised-network or insider/lateral-movement scenarios. No conflicting signals were found across the sources; the main gap is the absence of a vendor-confirmed fixed version - the only reference is the upstream GitLab issue (yaook/operator#631), not a formal advisory with remediation details.

An attacker who has gained a foothold on the same network segment as a YAOOK infra-operator MariaDB cluster passively intercepts the replication stream between database nodes, which is not properly secured. Because the replication channel transmits database contents in a readable form, the attacker extracts sensitive rows and potentially stored credentials without authenticating to the database. No public exploit code is identified at time of analysis; the attack requires only standard on-path traffic-capture capability given the adjacent network position (AV:A/AC:L).