An unauthenticated security bypass vulnerability in EDB Hybrid Manager allows unauthorized access to gRPC endpoints, potentially leading to data exposure or service disruption.

The vulnerability is caused by a missing authentication and authorization check within the Istio Gateway configuration. This flaw enables unauthenticated remote attackers to interact with gRPC endpoints that lack the necessary security policy definitions.

Successful exploitation of this flaw allows unauthorized actors to read sensitive data or trigger a denial-of-service condition by sending malformed data to the exposed endpoints. With a CVSS score of 7.0, this represents a high-severity risk that could compromise the confidentiality and availability of critical database management infrastructure.

Immediate Action: Upgrade EnterpriseDB Hybrid Manager to version 1.3.3 for the LTS release or 2025.12 for the Innovation release to apply the necessary Istio Gateway configuration fixes.

Proactive Monitoring: Review Istio Gateway and service access logs for unusual or unauthorized gRPC traffic patterns originating from unexpected sources.

Compensating Controls: Implement strict network-level access control lists (ACLs) to restrict access to the Hybrid Manager gRPC endpoints to authorized internal IP addresses only until the patch can be deployed.

Public Exploit Available: Unknown

Given the potential for unauthorized data access and service disruption, organizations running EnterpriseDB Hybrid Manager should prioritize this update. Verify your current version against the affected releases immediately and schedule the maintenance window required to move to the patched versions as soon as possible.