Vulnerability · Published Jun 17, 2025 · Assigned by GitHub_M
CVE-2025-49825Teleport allows remote authentication bypass
Critical 9.8
In plain English
A critical-severity incorrect authorization in teleport from gravitational. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.9% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/gravitational/teleport | 17.5.2 | GHSA-8cqv-pj7f-pwpc |
| Go | github.com/gravitational/teleport | 16.5.12 | GHSA-8cqv-pj7f-pwpc |
| Go | github.com/gravitational/teleport | 15.5.3 | GHSA-8cqv-pj7f-pwpc |
| Go | github.com/gravitational/teleport | 14.4.1 | GHSA-8cqv-pj7f-pwpc |
| Go | github.com/gravitational/teleport | 13.4.27 | GHSA-8cqv-pj7f-pwpc |
| Go | github.com/gravitational/teleport | 12.4.35 | GHSA-8cqv-pj7f-pwpc |
| Go | github.com/gravitational/teleport | no fix listed | GHSA-8cqv-pj7f-pwpc |
| Go | github.com/gravitational/teleport | no fix listed | GO-2025-3763 |
| Go | github.com/gravitational/teleport | no fix listed | GO-2025-3763 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gravitational | teleport | <= 17.5.1<= 0.0.0-20250616162021-79b2f26125a1 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H