Katanemo Plano EUVD-2026-97014

Exploitation requires the Envoy admin interface to be running and network-reachable on TCP port 9901 and at least one LLM provider API key to be configured in the WASM filter. Per the referenced config/envoy.template.yaml in Plano 0.4.37, the admin interface is bound to all host interfaces (0.0.0.0) by default, so stock deployments are exposed without any special configuration - there are no authentication, user-interaction, or non-default-setting prerequisites. The primary limiting factor is network topology: if operators firewall, bind to loopback, or otherwise isolate port 9901 from untrusted networks, remote exploitation is prevented. The flaw also only yields value when real provider keys are present in the WASM filter configuration.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a textbook low-effort, high-reward exposure: an unauthenticated network attacker needs only to reach TCP/9901 and issue a single GET to /config_dump, with no user interaction, no authentication, and no special attack requirements. The impact profile is narrow but severe on one axis - VC:H with VI:N and VA:N - meaning this is purely a confidentiality (secret-disclosure) flaw, not a code-execution or integrity/availability issue, which is why the base score lands at 8.7 rather than near 10. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding originates from VulnCheck research rather than observed attacks. The signals are internally consistent - the network vector, low complexity, and no-privilege requirement all align with the description of an admin port bound to all interfaces - so there is no contradiction to flag between CVSS and the narrative. The practical priority is high for anyone running Plano with 9901 exposed to untrusted networks because exploitation is trivial and yields live LLM provider API keys (enabling downstream billing abuse and lateral access to AI accounts), but the real-world blast radius is tempered by the product's niche footprint and by whether operators have network-isolated the admin port. Absent EPSS/KEV data, treat widespread opportunistic exploitation as plausible-but-unproven rather than confirmed.

An attacker scanning for exposed Envoy admin interfaces finds a Plano instance with port 9901 reachable and sends an unauthenticated HTTP request to /config_dump. The returned configuration includes the WASM filter settings, from which the attacker reads the configured LLM provider API keys in plaintext and reuses them to bill against or access the victim's AI accounts. No public exploit code is required - the attack is a single standard HTTP GET against a default-exposed endpoint.