CVE-2026-108863Published
Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108863 · Microsoft / collected KEV context
cve-program · CVE-2026-108863
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/katanemo-plano-envoy-admin-config-secret-disclosure
- https://github.com/katanemo/plano/blob/0.4.37/config/envoy.template.yaml#L1-L3
- https://github.com/katanemo/plano/blob/0.4.37/cli/planoai/config_generator.py#L588-L656
- https://github.com/katanemo/plano
- https://www.vulncheck.com/advisories/katanemo-plano-through-0.4.37-missing-authentication-on-envoy-admin-interface
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.