Hybrid Manager
Monthly
Unauthenticated network access to specific gRPC endpoints in EDB Hybrid Manager can be achieved because those endpoints were never declared in the Istio Gateway's authorization policy, letting requests bypass both authentication and authorization (CWE-306). Attackers with network reachability to the affected gRPC service can read potentially sensitive data (C:L) or push malformed payloads that degrade or deny service (A:H); the independent assessment scores this AV:N/AC:L/PR:N/UI:N at 7.0, i.e. no credentials are required, though only the omitted endpoints are exposed while correctly declared endpoints remain protected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is fixed in Hybrid Manager LTS 1.3.3 and Innovation 2025.12, so patched instances are not exploitable.
Unauthenticated network access to specific gRPC endpoints in EDB Hybrid Manager can be achieved because those endpoints were never declared in the Istio Gateway's authorization policy, letting requests bypass both authentication and authorization (CWE-306). Attackers with network reachability to the affected gRPC service can read potentially sensitive data (C:L) or push malformed payloads that degrade or deny service (A:H); the independent assessment scores this AV:N/AC:L/PR:N/UI:N at 7.0, i.e. no credentials are required, though only the omitted endpoints are exposed while correctly declared endpoints remain protected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is fixed in Hybrid Manager LTS 1.3.3 and Innovation 2025.12, so patched instances are not exploitable.