CVE-2025-14758 Initialization of a Resource with an Insecure Default in YAOOK
An on-path attacker can read database contents, including credentials, due to insecure default replication security settings in the YAOOK Operator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14758?
CVE-2025-14758 is a medium-severity vulnerability in ALASCA YAOOK, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials
Weakness: CWE-1188
Which versions are affected by CVE-2025-14758?
How do I fix CVE-2025-14758?
No fix has been published for CVE-2025-14758 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-14758 being exploited?
There is no known exploitation of CVE-2025-14758 in the wild and no public exploit code.
Sources
Also known as GHSA-r9rc-4fcg-85c7.