🛡️ CVE-2025-49825 — teleport

🔴 CVSS 9.8 — Critical ✅ No Known Exploit CWE-863 NVD
9.8
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Teleport allows remote authentication bypass

Impact

A full technical disclosure and open-source patch will be published after the embargo period, ending on June 30th, to allow all users to upgrade.

Teleport security engineers identified a critical security vulnerability that could allow remote authentication bypass of Teleport.

Teleport Cloud Infrastructure and CI/CD build, test, and release infrastructure aren’t affected.

For the full mitigation, upgrade both Proxy and Teleport agents. It is strongly recommend updating clients to the released patch versions as a precaution.

Have questions?

  • OSS Community: [opensource@goteleport.com](mailto:opensource@goteleport.com)
  • Legal: [legal@goteleport.com](mailto:legal@goteleport.com)
  • Security: [security@goteleport.com](mailto:security@goteleport.com)
  • Customer Support: [goteleport.com/support](https://goteleport.com/support)
  • Media Inquiries: [teleport@babelpr.com](mailto:teleport@babelpr.com)

Patches

Fixed in versions: 17.5.2, 16.5.12, 15.5.3, 14.4.1, 13.4.27, 12.4.35.

These patches are available only on the [official Teleport distribution channels](https://goteleport.com/docs/installation/).

These versions are designated as _Critical Security Exception Versions_.

_For these specific patch versions of Teleport Community Edition, the Community Edition restrictions are removed on employee count or revenue thresholds, as long as you apply the patch within thirty (30) days of its official release._

_Please read the full text of the updated Teleport Community Edition license for details._

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

Weakness class

CVE-2025-49825 is classified as CWE-863: Incorrect Authorization. An authorisation check runs but reaches the wrong conclusion, permitting actions it should refuse.

Affected software

CVE-2025-49825 is recorded against 2 packages.

  • github.com/gravitational/teleport
  • unknown

Timeline and source

Published on 16 June 2025 and last revised on 28 July 2025. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

github.com (Web)
nvd.nist.gov (Advisory)
github.com (Package)

Details

Severity CRITICAL
CVSS Score 9.8
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE CWE-863
Public Exploit ✅ No
Source NVD
Published 2025-06-16
Updated 2026-08-12
Modified 2025-07-28
Fix URL N/A

Affected Packages

Software From version Fixed in
github.com/gravitational/teleport — —
unknown — —

Similar Threats

Exploit Protection

Are you running teleport?

CVE-2025-49825 carries CVSS 9.8 Critical rating. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For CVE-2025-49825 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2025