CVE-2025-49825
Teleport allows remote authentication bypass
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Teleport allows remote authentication bypass
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
- Record
CVE-2025-49825- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2025-18566
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
- Record
EUVD-2025-18566- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8cqv-pj7f-pwpc
Teleport allows remote authentication bypass
Impact
A full technical disclosure and open-source patch will be published after the embargo period, ending on June 30th, to allow all users to upgrade.
Teleport security engineers identified a critical security vulnerability that could allow remote authentication bypass of Teleport.
Teleport Cloud Infrastructure and CI/CD build, test, and release infrastructure aren’t affected.
For the full mitigation, upgrade both Proxy and Teleport agents. It is strongly recommend updating clients to the released patch versions as a precaution.
Have questions?
- OSS Community: [email protected]
- Legal: [email protected]
- Security: [email protected]
- Customer Support: goteleport.com/support
- Media Inquiries: [email protected]
Patches
Fixed in versions: 17.5.2, 16.5.12, 15.5.3, 14.4.1, 13.4.27, 12.4.35.
These patches are available only on the official Teleport distribution channels.
These versions are designated as Critical Security Exception Versions.
For these specific patch versions of Teleport Community Edition, the Community Edition restrictions are removed on employee count or revenue thresholds, as long as you apply the patch within thirty (30) days of its official release.
Please read the full text of the updated Teleport Community Edition license for details.
- Record
GHSA-8cqv-pj7f-pwpc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
- Record
CVE-2025-49825- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Teleport allows remote authentication bypass
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
- Record
CVE-2025-49825- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-8cqv-pj7f-pwpc
Teleport allows remote authentication bypass
Impact
A full technical disclosure and open-source patch will be published after the embargo period, ending on June 30th, to allow all users to upgrade.
Teleport security engineers identified a critical security vulnerability that could allow remote authentication bypass of Teleport.
Teleport Cloud Infrastructure and CI/CD build, test, and release infrastructure aren’t affected.
For the full mitigation, upgrade both Proxy and Teleport agents. It is strongly recommend updating clients to the released patch versions as a precaution.
Have questions?
- OSS Community: [email protected]
- Legal: [email protected]
- Security: [email protected]
- Customer Support: goteleport.com/support
- Media Inquiries: [email protected]
Patches
Fixed in versions: 17.5.2, 16.5.12, 15.5.3, 14.4.1, 13.4.27, 12.4.35.
These patches are available only on the official Teleport distribution channels.
These versions are designated as Critical Security Exception Versions.
For these specific patch versions of Teleport Community Edition, the Community Edition restrictions are removed on employee count or revenue thresholds, as long as you apply the patch within thirty (30) days of its official release.
Please read the full text of the updated Teleport Community Edition license for details.
- Record
GHSA-8cqv-pj7f-pwpc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGO-2025-3763 No score
Remote authentication bypass in github.com/gravitational/teleport
Remote authentication bypass in github.com/gravitational/teleport.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/gravitational/teleport from v16.0.0 before v16.5.12; github.com/gravitational/teleport before v12.4.35, from v13.0.0 before v13.4.27, from v14.0.0 before v14.4.1, from v15.0.0 before v15.5.3, from v17.0.0 before v17.5.2.
- Record
GO-2025-3763- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15300-1 No score
teleport-17.5.3-1.1 on GA media
These are all security issues fixed in the teleport-17.5.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15300-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15405-1 No score
govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/gravitational/teleportGo |
17.0.0 up to 17.5.2 | 17.5.2 |
github.com/gravitational/teleportGo |
16.0.0 up to 16.5.12 | 16.5.12 |
github.com/gravitational/teleportGo |
15.0.0 up to 15.5.3 | 15.5.3 |
github.com/gravitational/teleportGo |
14.0.0 up to 14.4.1 | 14.4.1 |
github.com/gravitational/teleportGo |
13.0.0 up to 13.4.27 | 13.4.27 |
github.com/gravitational/teleportGo |
0.0.11 up to 12.4.35 | 12.4.35 |
github.com/gravitational/teleportGo |
through 0.0.0-20250616162021-79b2f26125a1 | None known |
github.com/gravitational/teleportGo |
All versions | None known |
github.com/gravitational/teleportGo |
0.0.11 and later | None known |
teleportopenSUSE:Tumbleweed |
before 17.5.3-1.1 | 17.5.3-1.1 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 56 CVEs |
before 0.0.20250730T213748-1.1 | 0.0.20250730T213748-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Teleport - Authentication Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49825 is a critical vulnerability (CVSS 9.8) in Gravitational Teleport, published June 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.92%, the 94th percentile. Fixed in github.com/gravitational/teleport 17.5.2.
References
github.com/gravitational/teleport/security/advisories/GHSA-8cqv-pj7f-pwpc
nvd.nist.gov/vuln/detail/CVE-2025-49825
suse.com/security/cve/CVE-2025-49825
Show 55 moreShow less