erroneo.us
Search all guides⌘K

Security Digest · May 21, 2025 · Vulnerability · Network edge

Versa Concerto CVE-2025-34026: Actuator Auth Bypass

A Traefik header trick exposes Versa Concerto Actuator heap dumps and traces. Fixed in 12.2.1 (Apr 2025), in KEV since Jan 2026. Upgrade, rotate admin creds.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

Fixed since spring 2025 and now confirmed exploited; any Concerto portal on 12.2.0 or earlier that is reachable from untrusted networks should be upgraded, taken off the internet, and treated as a credential leak.

Who must act: Service providers and enterprises running self-hosted Versa Concerto 12.2.0 or earlier, most urgently where the Concerto portal is reachable from the internet.

Who can relax: Teams already on Concerto 12.2.1 or later whose portal is reachable only from a management network, and Versa customers who do not run Concerto (Versa Director is a different product).

Affected
Versa Concerto 12.1.2 through 12.2.0 (CVE record); other versions may also be vulnerable
Fixed in
Hotfixes made available to customers on Mar 7, 2025 (per Versa)
Concerto 12.2.1 GA, released Apr 16, 2025
CVSS
9.2 (v4.0, CNA)
EPSS
81.8% (percentile 99.6)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every Versa Concerto instance and record its version; upgrade anything on 12.2.0 or earlier to 12.2.1 or a later release.
  2. Put the Concerto portal behind a VPN or management-network allowlist so it is not reachable from the internet.
  3. Until upgraded, have the reverse proxy or WAF in front drop requests whose Connection header contains X-Real-IP and block semicolons in URL paths.
  4. If a vulnerable portal was reachable from untrusted networks, rotate all Concerto admin passwords and API credentials and end active sessions.
  5. Review the companion bugs CVE-2025-34027 and CVE-2025-34025, fixed in the same releases, when you plan the upgrade.

How to check if you are affected or compromised

  • Search reverse-proxy and Traefik access logs for requests to /actuator or /portalapi/actuator paths, especially heapdump and traces, from outside your admin network.
  • If your edge logs request headers, look for Connection headers that name X-Real-IP, and for semicolons in URL paths.
  • Review Concerto admin logins and sessions for unfamiliar source addresses since the portal was first exposed.
  • Look for unexpected uploads to /portalapi/v1/package/spack/upload and unexpected shared libraries or LD_PRELOAD changes in Concerto containers, signs of the RCE chain.

What happened#

On May 21, 2025, ProjectDiscovery researchers Harsh Jaiswal, Rahul Maini and Parth Malhotra published three flaws in Versa Concerto. Concerto is the orchestration and management portal for Versa's SD-WAN and SASE deployments. It runs in Docker containers behind a Traefik reverse proxy. VulnCheck assigned the CVEs that day. CVE-2025-34026 is the Actuator authentication bypass. The CVE record scores it CVSS 4.0 9.2 and lists Concerto 12.1.2 through 12.2.0, noting other versions may be vulnerable. NVD rates it 7.5 under CVSS 3.1.

The bug is simple. Concerto blocked external access to Spring Boot Actuator endpoints by checking for an X-Real-IP header, which Traefik adds to proxied requests. A Traefik bug (GHSA-62c8-mh53-4cqv, CVE-2024-45410) let a client strip headers Traefik adds by naming them in the Connection header, which marks them hop-by-hop. So a request carrying Connection: X-Real-IP reached the backend without the header, and the check never fired. That opens /portalapi/actuator. Heap dumps can hold plaintext credentials, and /portalapi/actuator/traces can expose session tokens. Both lead to an admin login. The same post chained CVE-2025-34027, a URL-decoding auth bypass to file write and RCE, with CVE-2025-34025, a Docker mount that allows container escape.

ProjectDiscovery reported the bugs on February 13, 2025. It published after its 90-day deadline, and early coverage called the flaws unpatched. Versa then told The Hacker News that hotfixes reached customers on March 7, 2025, and that a GA release with the fixes shipped on April 16, 2025. At the time, Versa said there was "no indication" of exploitation.

Who is affected#

Self-hosted Concerto 12.1.2 through 12.2.0, and possibly other versions. The Hacker News names 12.2.1 GA as the fixed release. Versa's own bulletin sits behind its customer portal login, so we could not read it. Versa Director, a separate product, is not covered by this CVE.

Do you really need to act?#

CISA added CVE-2025-34026 to KEV on January 22, 2026, eight months after disclosure, with a February 12 deadline. It came in a batch with Zimbra, Vite and eslint-config-prettier bugs. BleepingComputer notes that CISA shared no details of the activity. We found no public report that names an actor or campaign as of October 23, 2026. Our read is that ease explains the interest. The bypass is one header. Full write-ups have been public since May 2025, and ProjectDiscovery added Nuclei templates for it that month. Neither CVE-2025-34027 nor CVE-2025-34025 is in KEV.

So the verdict is check exposure. If you run Concerto 12.2.1 or later and the portal is reachable only from a management network, you are done. If an older portal was internet-facing, upgrading is not enough. Assume its credentials and sessions leaked.

What to do now#

  1. Find every Concerto instance and record its version. Upgrade anything on 12.2.0 or earlier.
  2. Restrict the portal to a VPN or management allowlist.
  3. Until you upgrade, have the proxy or WAF in front drop requests whose Connection header contains X-Real-IP, and block ; in URL paths. ProjectDiscovery recommends both as temporary measures.
  4. If a vulnerable portal was exposed, rotate admin passwords and API credentials and end all sessions.

How to tell if you were hit#

Check proxy logs, for example grep -E 'actuator/(heapdump|traces)' access.log, for hits from outside your admin network. Review Concerto admin logins for unfamiliar sources. To spot follow-on RCE, look for uploads to /portalapi/v1/package/spack/upload and unexpected shared libraries or LD_PRELOAD changes in Concerto containers.

Timeline#

  • — ProjectDiscovery reports the bugs to Versa.
  • — Versa says hotfixes are available to customers.
  • — GA release with the fixes, per Versa.
  • — Public disclosure; CVEs assigned.
  • — CISA adds CVE-2025-34026 to KEV.
  • — Federal remediation deadline.

Vulnerability records

  • CVE-2025-34026 · KEV 2026-01-22 · The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. ProjectDiscovery — Authentication Bypass to RCE in Versa Concerto projectdiscovery.io
  2. CVE record — CVE-2025-34026 cve.org
  3. NVD — CVE-2025-34026 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2025-34026 cisa.gov
  5. GitHub Advisory — Traefik: HTTP client can manipulate custom HTTP headers that are added by Traefik (GHSA-62c8-mh53-4cqv) github.com
  6. ProjectDiscovery — Nuclei Templates Monthly - May 2025 projectdiscovery.io

Coverage and analysis

  1. The Hacker News — Critical Versa Concerto Flaws Let Attackers Escape Docker and Compromise Hosts (with Versa statement) thehackernews.com
  2. The Hacker News — CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities thehackernews.com
  3. BleepingComputer — CISA confirms active exploitation of four enterprise software bugs bleepingcomputer.com