Skip to content
Threat Feed
Subscribe
high advisory

YETI: Authentication bypass in audit router (CVE-2026-63482)

The YETI Forensics Intelligence platform prior to version 2.5.1 contains an authentication bypass vulnerability allowing unauthenticated attackers to retrieve sensitive audit logs via the API.

CVE search metadata

CVE search record: CVE-2026-63482. KEV: no. Product: YETI (< 2.5.1), Yeti (<= 2.5.0). Brief: YETI: Authentication bypass in audit router (CVE-2026-63482). Brief link: https://feed.craftedsignal.io/briefs/2026-11-yeti-auth-bypass/

CVE search record: CVE-2026-63502. Severity: high. CVSS: 8.3. KEV: no. Product: YETI (< 2.5.1), Yeti (<= 2.5.0). Brief: YETI: Authentication bypass in audit router (CVE-2026-63482). Brief link: https://feed.craftedsignal.io/briefs/2026-11-yeti-auth-bypass/

CVE search record: CVE-2026-63489. Severity: high. CVSS: 7.6. KEV: no. Product: YETI (< 2.5.1), Yeti (<= 2.5.0). Brief: YETI: Authentication bypass in audit router (CVE-2026-63482). Brief link: https://feed.craftedsignal.io/briefs/2026-11-yeti-auth-bypass/

Triage facts

Revision 2
Applicability
YETI (< 2.5.1), Yeti (<= 2.5.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 2Nov 4, 00:26 UTC
Vulnerabilities
3 CVEs
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    added coverage for Yeti (<= 2.5.0)

    Changed: action_plan, affected_products, cves, lastmod, references, tags, ttps, updates

    Sources: 1

YETI versions prior to 2.5.1 contain an authentication bypass vulnerability in the audit router. The file core/web/apiv2/audit.py fails to implement the required auth.get_current_active_user dependency for the /api/v2/audit/timeline/{id} endpoint. An unauthenticated attacker can exploit this to query sensitive TimelineLog records, which contain analyst usernames, object identifiers, and historical threat intelligence object data.

Impact

Unauthorized exposure of operational threat intelligence, including analyst identity and sensitive object modification history.

Recommendation

Upgrade the YETI platform to version 2.5.1 or later to apply the missing route-level authentication checks.

Hunt Leads

  • Lead: Audit access to the /api/v2/audit/timeline/ endpoint data_needed:
  • Web server access logs or application-level API request logs priority: "high" confidence: "high" disposition: "hunt_now" evidence: "An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields."

Immediate actions

Upgrade YETI to version 2.5.1 or later

IT Operations 48h

Upgrade YETI to version 2.5.1

IT Operations 48h

Inventory all Yeti instances and restrict access to the /api/v2/ endpoints to authenticated users with explicit business requirements.

SOC 24h

Threat Hunt

Identify unauthorized access to /api/v2/audit/timeline/ in web application logs

T1592 high high confidence hunt now

Data: Web server access logs

Hunt for directory traversal patterns in API requests

T1190 high high confidence hunt now

Data: Web server access logs

Hunt for abnormal POST requests to /api/v2/search/ endpoints containing AQL syntax elements (e.g., semicolons, FOR, RETURN, FILTER, SORT).

T1190 high medium confidence hunt now

Data: Web server access logs, Application audit logs for /api/v2/ endpoints

Mitigations

Restrict network access to the YETI management interface if immediate patching is not possible

immediate IT Operations

CVE-2026-63482

Upgrade to YETI 2.5.1

immediate IT Operations

CVE-2026-63502

Monitor for official security patches for Yeti and apply immediately upon release.

immediate IT Operations

CVE-2026-63489