Description
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.
Problem types
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Product status
2025.*
2024.*
2.20.*
References
docs.yugabyte.com/...secure/vulnerability-disclosure-policy/
