EUVD-2025-18566
GHSA-8cqv-pj7f-pwpc
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
AnalysisAI
Critical remote authentication bypass vulnerability affecting Teleport Community Edition versions 17.5.1 and earlier, allowing unauthenticated attackers to completely compromise authentication mechanisms over the network without any user interaction. With a CVSS score of 9.8 and no available open-source patch at disclosure, this vulnerability represents an immediate threat to all affected Teleport deployments, enabling full system compromise including confidentiality, integrity, and availability violations.
Technical ContextAI
Teleport is an infrastructure connectivity and access control platform that acts as a centralized authentication and audit gateway. The vulnerability resides in the Community Edition authentication subsystem (likely affecting CPE patterns: cpe:2.3:a:gravitational:teleport:*:*:*:*:community:*). CWE-863 (Incorrect Authorization) indicates the root cause is improper validation of authentication credentials or session tokens, allowing attackers to bypass the authentication layer entirely. This affects the core security function of the platform—the authentication module that should validate all access requests before granting access to infrastructure resources. The bypass is network-accessible (AV:N) with no authentication prerequisites (PR:N) and no user interaction required (UI:N), suggesting the flaw exists in the initial authentication handshake or token validation logic.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today