Is CVE-2025-59036 actively exploited?

No active exploitation of CVE-2025-59036 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-59036 be exploited remotely?

Yes. CVE-2025-59036 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-59036?

CVE-2025-59036 has a CVSS score of 5.5 (MEDIUM).

HOME VULNERABILITIESCVE-2025-59036

MEDIUM

CVE-2025-59036

CWE-298Published: September 9, 2025· Updated: Jun 17, 2026

5.5

CVSS v3.1

Official Description

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.

NVD Source

Technical Analysis

CVE-2025-59036 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.