CVE-2025-59036 Infrahub allows authentication with deleted and expired API tokens
Attackers can authenticate using deleted or expired API tokens, bypassing intended access controls in Infrahub.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-59036?
CVE-2025-59036 is a medium-severity authentication bypass vulnerability in opsmill infrahub, published on 9 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
Weakness: CWE-298
Which versions are affected by CVE-2025-59036?
5 open source packages ship an affected version, including infrahub-server.
| Package | Affected | Fixed in |
|---|---|---|
infrahub-server PyPI | All versions | 1.3.9, 1.4.5 |
infrahub-server PyPI | All versions | 1.3.9 |
infrahub-server PyPI | All versions | 1.3.9 |
infrahub-server PyPI | From 1.4.0 | 1.4.5 |
infrahub-server PyPI | From 1.4.0 | 1.4.5 |
How do I fix CVE-2025-59036?
Upgrade infrahub-server to a fixed version for your release line: 1.3.9 or 1.4.5.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-59036 being exploited?
There is no known exploitation of CVE-2025-59036 in the wild and no public exploit code.
Sources
Also known as GHSA-v2p7-4pv4-3wwh, PYSEC-2026-1463.