CVE-2025-34026 is an authentication-bypass vulnerability in Versa Concerto's Traefik reverse-proxy layer: Concerto only blocks requests to its internal Spring Boot Actuator endpoint when they carry an X-Real-Ip header, so an attacker can send a request with a Connection: X-Real-Ip header that causes a vulnerable Traefik version to strip that exact header, reach the Actuator unauthenticated, and pull heap dumps and trace logs that researchers chained with two sibling flaws into full host-level remote code execution.
Vulnerability summary
7.5
High
81.8%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-05-21
Published
Vulnerability ID: CVE-2025-34026 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Versa Networks Concerto | cpe:2.3:a:versa-networks:concerto:*:*:*:*:*:*:*:* | 11.4.0 through 12.1.2, and 12.2.0; vendor bulletin additionally lists 12.1.2 through 12.2.0 as affected, with additional versions possibly vulnerable |
What this means
CVE-2025-34026 is an improper authentication vulnerability (CWE-288). NVD's description states: "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs. This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable" (NVD).
NVD has published its own independent Primary CVSS metric: CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD). NVD's CPE applicability data additionally lists Concerto 11.4.0 up to (but excluding) 12.1.2, plus the specific builds 12.1.2 and 12.2.0, as vulnerable configurations.
Security research firm ProjectDiscovery, which disclosed the issue, explains the root cause: Concerto's authentication filter denies Actuator access only when an X-Real-Ip header is present on the request, while a vulnerable version of the bundled Traefik reverse proxy (tracked separately as GHSA-62c8-mh53-4cqv) can be made to drop that exact header when the client sends a Connection: X-Real-Ip header — letting the request reach the Actuator endpoint with no authentication at all. ProjectDiscovery chained this Actuator exposure (CVE-2025-34026) with a URL-decoding authentication bypass leading to a file-write race condition (CVE-2025-34027) and an insecure Docker bind-mount of /usr/bin and /bin into the core-service container (CVE-2025-34025) to achieve full host remote code execution. The researchers reported the chain to Versa on 2025-02-13; Versa shipped patches on 2025-03-07, ahead of the coordinated public disclosure on 2025-05-21 (ProjectDiscovery).
Versa published its own security bulletin for this issue, which NVD lists as the vendor advisory of record (Versa Security Bulletin).
CISA added CVE-2025-34026 to the Known Exploited Vulnerabilities catalog on 2026-01-22, with a required-action due date of 2026-02-12 (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.8178 (99.644th percentile), consistent with a vulnerability that is both KEV-listed and part of a documented, publicly detailed exploit chain (FIRST EPSS).
Because this flaw is one link in a chain that ends in host-level code execution, Concerto operators should patch to a fixed release, update the bundled Traefik component past GHSA-62c8-mh53-4cqv, and audit for the sibling authentication-bypass (CVE-2025-34027) and Docker-mount (CVE-2025-34025) issues rather than treating the Actuator exposure in isolation.
Evidence
- Versa Concerto's Traefik reverse-proxy configuration lets an attacker bypass authentication and reach the internal Actuator endpoint, exposing heap dumps and trace logs; affects Concerto 12.1.2 through 12.2.0 per the vendor, with additional versions possibly vulnerable. — NVD
- NVD Primary CVSS v3.1 base score is 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. — NVD
- Root cause: the Actuator is only blocked when an X-Real-Ip header is present; sending Connection: X-Real-Ip causes a vulnerable Traefik version to strip that header, bypassing the check. Chained with CVE-2025-34027 (auth bypass to file write) and CVE-2025-34025 (Docker mount) for host RCE. Reported 2025-02-13, patched 2025-03-07, disclosed 2025-05-21. — ProjectDiscovery
- Versa's own security bulletin for this issue is listed by NVD as the vendor advisory of record. — Versa Security Bulletin
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-01-22, required-action due date 2026-02-12. — CISA KEV
- EPSS score is 0.8178 (99.644th percentile) as of 2026-10-29. — FIRST EPSS
