Unauthenticated Access in EDB Hybrid Manager by EnterpriseDB

CVE-2025-14038

What is CVE-2025-14038?

EDB Hybrid Manager contains a security flaw that enables unauthenticated attackers to access specific gRPC endpoints, potentially allowing them to read sensitive data or launch denial-of-service attacks by sending malformed data. This issue arises from misconfigurations within the Istio Gateway, which governs the authentication and authorization protocols for these endpoints. Affected organizations should upgrade to EDB Hybrid Manager version 1.3.3 for the LTS version, and 2025.12 for the Innovation version, to mitigate associated risks.

References