Plano
Monthly
Unauthenticated information disclosure in Katanemo Plano through 0.4.37 allows any network attacker who can reach TCP port 9901 to read plaintext LLM provider API keys by issuing a single GET request to the Envoy admin interface's /config_dump endpoint. The Envoy admin listener is bound to all host interfaces (0.0.0.0) in the shipped config/envoy.template.yaml, so stock deployments are exposed by default; the only real barriers are network reachability to port 9901 and the presence of at least one configured provider key, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, C:H) reflects a low-effort, high-reward credential theft with no authentication or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, although the flaw has been publicly documented by VulnCheck.
Unauthenticated information disclosure in Katanemo Plano through 0.4.37 allows any network attacker who can reach TCP port 9901 to read plaintext LLM provider API keys by issuing a single GET request to the Envoy admin interface's /config_dump endpoint. The Envoy admin listener is bound to all host interfaces (0.0.0.0) in the shipped config/envoy.template.yaml, so stock deployments are exposed by default; the only real barriers are network reachability to port 9901 and the presence of at least one configured provider key, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, C:H) reflects a low-effort, high-reward credential theft with no authentication or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, although the flaw has been publicly documented by VulnCheck.