CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2025-49825
Critical (9.8). EPSS 7.9% chance of exploitation in the next 30 days. Fixed in github.com/gravitational/teleport 12.4.35, 13.4.27, 14.4.1.
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
Severity
- EPSS
- 7.9% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8cqv-pj7f-pwpc | Go | github.com/gravitational/teleport | >=17.0.0 <17.5.2 | 17.5.2 |
| GHSA-8cqv-pj7f-pwpc | Go | github.com/gravitational/teleport | >=16.0.0 <16.5.12 | 16.5.12 |
| GHSA-8cqv-pj7f-pwpc | Go | github.com/gravitational/teleport | >=15.0.0 <15.5.3 | 15.5.3 |
| GHSA-8cqv-pj7f-pwpc | Go | github.com/gravitational/teleport | >=14.0.0 <14.4.1 | 14.4.1 |
| GHSA-8cqv-pj7f-pwpc | Go | github.com/gravitational/teleport | >=13.0.0 <13.4.27 | 13.4.27 |
| GHSA-8cqv-pj7f-pwpc | Go | github.com/gravitational/teleport | >=0.0.11 <12.4.35 | 12.4.35 |
| GHSA-8cqv-pj7f-pwpc | Go | github.com/gravitational/teleport | <=0.0.0-20250616162021-79b2f26125a1 | no fix published |
| GO-2025-3763 | Go | github.com/gravitational/teleport | all versions | no fix published |
| GO-2025-3763 | Go | github.com/gravitational/teleport | >=0.0.11 | no fix published |