YugabyteDB vulnerabilities
We track 5 vulnerabilities in YugabyteDB products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 11, 2025.
Latest YugabyteDB vulnerabilities
- 7.0 High severity
YugabyteDB: Insertion of Sensitive Information Into Sent Data
YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacted.
- 7.5 High severity
Anywhere: Improper Access Control
The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. Th
- 9.8 Critical severity
YugabyteDB Anywhere: Improper Limitation of a Pathname to a Restricted Directory
The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This iss
- 9.8 Critical severity
YugabyteDB: Improper Control of Generation of Code
External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipula
- 9.8 Critical severity
YugabyteDB Anywhere: Improper Restriction of Excessive Authentication Attempts
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Pr