Description
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| YugabyteDB | YugabyteDB Anywhere | 2024.*, 2.20.* | 2025.* |