Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-58366

Good to know:

icon

Date: September 5, 2025

Onyxia is a data science environment for kubernetes. In versions 4.6.0 through 4.8.0, Onyxia-API leaked the credentials of private helm repositories in the public (unauthenticated) /public/catalogs endpoint.vOnly instances using private helm repositories (i.e setting username & password in the catalogs configuration) are affected. This is fixed in version 4.9.0.

Severity Score

Related Resources (5)

https://github.com/InseeFrLab/onyxia-api/releases/tag/v4.9.0
https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-m773-6vm8-8x6q
https://github.com/InseeFrLab/onyxia-api/pull/613
https://nvd.nist.gov/vuln/detail/CVE-2025-58366
https://www.mend.io/vulnerability-database/CVE-2025-58366

Severity Score

Weakness Type (CWE)

Insufficiently Protected Credentials

CWE-522

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/InseeFrLab/onyxia-api.git - v4.9.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us