---
title: "Versa Concerto CVE-2025-34026: Actuator Auth Bypass"
url: https://erroneo.us/security/briefs/versa-concerto-cve-2025-34026-actuator-auth-bypass/
description: "A Traefik header trick exposes Versa Concerto Actuator heap dumps and traces. Fixed in 12.2.1 (Apr 2025), in KEV since Jan 2026. Upgrade, rotate admin creds."
type: security-brief
section: "Security Digest"
date_published: 2025-05-21
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-34026"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Versa Concerto CVE-2025-34026: Actuator Auth Bypass

**Verdict: Check exposure.** Fixed since spring 2025 and now confirmed exploited; any Concerto portal on 12.2.0 or earlier that is reachable from untrusted networks should be upgraded, taken off the internet, and treated as a credential leak.

- **Who must act:** Service providers and enterprises running self-hosted Versa Concerto 12.2.0 or earlier, most urgently where the Concerto portal is reachable from the internet.
- **Who can relax:** Teams already on Concerto 12.2.1 or later whose portal is reachable only from a management network, and Versa customers who do not run Concerto (Versa Director is a different product).
- **Affected:** Versa Concerto 12.1.2 through 12.2.0 (CVE record); other versions may also be vulnerable
- **Fixed:** Hotfixes made available to customers on Mar 7, 2025 (per Versa); Concerto 12.2.1 GA, released Apr 16, 2025
- **CVEs:** CVE-2025-34026
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Versa Concerto instance and record its version; upgrade anything on 12.2.0 or earlier to 12.2.1 or a later release.
2. Put the Concerto portal behind a VPN or management-network allowlist so it is not reachable from the internet.
3. Until upgraded, have the reverse proxy or WAF in front drop requests whose Connection header contains X-Real-IP and block semicolons in URL paths.
4. If a vulnerable portal was reachable from untrusted networks, rotate all Concerto admin passwords and API credentials and end active sessions.
5. Review the companion bugs CVE-2025-34027 and CVE-2025-34025, fixed in the same releases, when you plan the upgrade.

### How to check if you are affected

- Search reverse-proxy and Traefik access logs for requests to /actuator or /portalapi/actuator paths, especially heapdump and traces, from outside your admin network.
- If your edge logs request headers, look for Connection headers that name X-Real-IP, and for semicolons in URL paths.
- Review Concerto admin logins and sessions for unfamiliar source addresses since the portal was first exposed.
- Look for unexpected uploads to /portalapi/v1/package/spack/upload and unexpected shared libraries or LD_PRELOAD changes in Concerto containers, signs of the RCE chain.

## What happened

On May 21, 2025, ProjectDiscovery researchers Harsh Jaiswal, Rahul Maini and Parth Malhotra [published three flaws](https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce) in Versa Concerto. Concerto is the orchestration and management portal for Versa's SD-WAN and SASE deployments. It runs in Docker containers behind a Traefik reverse proxy. VulnCheck assigned the CVEs that day. CVE-2025-34026 is the Actuator authentication bypass. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-34026) scores it CVSS 4.0 9.2 and lists Concerto 12.1.2 through 12.2.0, noting other versions may be vulnerable. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-34026) rates it 7.5 under CVSS 3.1.

The bug is simple. Concerto blocked external access to Spring Boot Actuator endpoints by checking for an `X-Real-IP` header, which Traefik adds to proxied requests. A Traefik bug ([GHSA-62c8-mh53-4cqv](https://github.com/advisories/GHSA-62c8-mh53-4cqv), CVE-2024-45410) let a client strip headers Traefik adds by naming them in the `Connection` header, which marks them hop-by-hop. So a request carrying `Connection: X-Real-IP` reached the backend without the header, and the check never fired. That opens `/portalapi/actuator`. Heap dumps can hold plaintext credentials, and `/portalapi/actuator/traces` can expose session tokens. Both lead to an admin login. The same post chained CVE-2025-34027, a URL-decoding auth bypass to file write and RCE, with CVE-2025-34025, a Docker mount that allows container escape.

ProjectDiscovery reported the bugs on February 13, 2025. It published after its 90-day deadline, and early coverage called the flaws unpatched. Versa then told [The Hacker News](https://thehackernews.com/2025/05/unpatched-versa-concerto-flaws-let.html) that hotfixes reached customers on March 7, 2025, and that a GA release with the fixes shipped on April 16, 2025. At the time, Versa said there was "no indication" of exploitation.

## Who is affected

Self-hosted Concerto 12.1.2 through 12.2.0, and possibly other versions. [The Hacker News](https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html) names 12.2.1 GA as the fixed release. Versa's own bulletin sits behind its customer portal login, so we could not read it. Versa Director, a separate product, is not covered by this CVE.

## Do you really need to act?

CISA added CVE-2025-34026 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026) on January 22, 2026, eight months after disclosure, with a February 12 deadline. It came in a batch with Zimbra, Vite and eslint-config-prettier bugs. [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-confirms-active-exploitation-of-four-enterprise-software-bugs/) notes that CISA shared no details of the activity. We found no public report that names an actor or campaign as of October 23, 2026. Our read is that ease explains the interest. The bypass is one header. Full write-ups have been public since May 2025, and ProjectDiscovery added [Nuclei templates](https://projectdiscovery.io/blog/nuclei-templates-monthly-may-2025) for it that month. Neither CVE-2025-34027 nor CVE-2025-34025 is in KEV.

So the verdict is check exposure. If you run Concerto 12.2.1 or later and the portal is reachable only from a management network, you are done. If an older portal was internet-facing, upgrading is not enough. Assume its credentials and sessions leaked.

## What to do now

1. Find every Concerto instance and record its version. Upgrade anything on 12.2.0 or earlier.
2. Restrict the portal to a VPN or management allowlist.
3. Until you upgrade, have the proxy or WAF in front drop requests whose `Connection` header contains `X-Real-IP`, and block `;` in URL paths. ProjectDiscovery recommends both as temporary measures.
4. If a vulnerable portal was exposed, rotate admin passwords and API credentials and end all sessions.

## How to tell if you were hit

Check proxy logs, for example `grep -E 'actuator/(heapdump|traces)' access.log`, for hits from outside your admin network. Review Concerto admin logins for unfamiliar sources. To spot follow-on RCE, look for uploads to `/portalapi/v1/package/spack/upload` and unexpected shared libraries or `LD_PRELOAD` changes in Concerto containers.

## Timeline

- Feb 13, 2025 — ProjectDiscovery reports the bugs to Versa.
- Mar 7, 2025 — Versa says hotfixes are available to customers.
- Apr 16, 2025 — GA release with the fixes, per Versa.
- May 21, 2025 — Public disclosure; CVEs assigned.
- Jan 22, 2026 — CISA adds CVE-2025-34026 to KEV.
- Feb 12, 2026 — Federal remediation deadline.

## Sources

1. [ProjectDiscovery — Authentication Bypass to RCE in Versa Concerto](https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce)
2. [CVE record — CVE-2025-34026](https://www.cve.org/CVERecord?id=CVE-2025-34026)
3. [NVD — CVE-2025-34026](https://nvd.nist.gov/vuln/detail/CVE-2025-34026)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-34026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026)
5. [GitHub Advisory — Traefik: HTTP client can manipulate custom HTTP headers that are added by Traefik (GHSA-62c8-mh53-4cqv)](https://github.com/advisories/GHSA-62c8-mh53-4cqv)
6. [ProjectDiscovery — Nuclei Templates Monthly - May 2025](https://projectdiscovery.io/blog/nuclei-templates-monthly-may-2025)
7. [The Hacker News — Critical Versa Concerto Flaws Let Attackers Escape Docker and Compromise Hosts (with Versa statement)](https://thehackernews.com/2025/05/unpatched-versa-concerto-flaws-let.html)
8. [The Hacker News — CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities](https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html)
9. [BleepingComputer — CISA confirms active exploitation of four enterprise software bugs](https://www.bleepingcomputer.com/news/security/cisa-confirms-active-exploitation-of-four-enterprise-software-bugs/)

---
Source page: https://erroneo.us/security/briefs/versa-concerto-cve-2025-34026-actuator-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt