CVE-2025-59036 json
Infrahub allows authentication with deleted and expired API tokens
published last yr. modified 4mo ago also GHSA-v2p7-4pv4-3wwh , PYSEC-2026-1463 , EUVD-2025-27503
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
Patch / fix
- pypi infrahub-server 1.3.9, 1.4.5
Is CVE-2025-59036 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 5.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | infrahub-server | <1.3.9 >=1.4.0, <1.4.5 |
1.3.9 1.4.5 |
Affected products
- opsmill infrahub
Classification
- Weakness
-
- CWE-298 Improper Validation of Certificate Expiration
References
-
github.com
/opsmill/infrahub/commit/215185f217e2f754f7c0a0aa4b77e11079a063a1
web
-
github.com
/opsmill/infrahub/commit/61b49a4a9e988f10c3a44f0e86ef97f344a1e228
web
-
github.com
/opsmill/infrahub/security/advisories/GHSA-v2p7-4pv4-3wwh
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-59036
advisory
-
github.com
/opsmill/infrahub
package
-
github.com
/opsmill/infrahub/releases/tag/infrahub-v1.3.9
web
-
github.com
/opsmill/infrahub/releases/tag/infrahub-v1.4.5
web
-
pypi.org
/project/infrahub-server
package
-
github.com
/advisories/GHSA-v2p7-4pv4-3wwh
advisory
Sources
- CVE List CVE-2025-59036
- GitHub Advisory GHSA-v2p7-4pv4-3wwh
- NVD CVE-2025-59036
- OSV PYSEC-2026-1463
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.