Critical Teleport Flaw Lets Attackers Bypass Authentication Remotely

Teleport security engineers have disclosed a critical vulnerability (CVE-2025-49825) allowing remote attackers to bypass SSH authentication and access managed systems.

The flaw, rated 9.8 on the CVSS scale, impacts Teleport Community Edition versions up to 17.5.1.

Patched versions (17.5.2, 16.5.12, 15.5.3, 14.4.1, 13.4.27, and 12.4.35) were released on June 9, 2025, with Teleport Cloud customers receiving automatic updates.

Self-hosted deployments require manual intervention for full mitigation.

Technical Impact and Attack Surface

The vulnerability enables unauthenticated attackers to circumvent SSH controls on Teleport-managed systems, including OpenSSH-integrated deployments and Git proxy setups.

Exploitation could grant unauthorized access to critical infrastructure, though no public proof-of-concept or active exploits exist currently.

The flaw affects all nodes running vulnerable Teleport agents, with Kubernetes environments particularly at risk if using unpatched SSH services.

Fortinet confirms the vulnerability stems from an authentication bypass mechanism in Teleport’s SSH handling, allowing network-based attackers to compromise confidentiality, integrity, and availability without user interaction.

Mitigation Strategies

Cloud customers with agents enrolled in Managed Updates v2 received automatic patches during their maintenance window on June 9.

Self-hosted users must:

1. Upgrade all nodes to patched versions matching their cluster’s major release.
2. Enroll agents in Managed Updates v2 using:

bashsudo teleport-update enable  

For legacy agents (pre-v14), identify vulnerable nodes using tctl inventory commands and upgrade manually before enrollment.

Kubernetes deployments require teleport-kube-agent updates instead of teleport-update to maintain compatibility.

Enterprise Response and FAQs

Teleport designated the patches as Critical Security Exception Versions, temporarily lifting Community Edition restrictions for organizations applying updates within 30 days.

Key FAQs:

• Locked agents: Update, then manually remove locks via tctl.
• Managed Updates v1: Still functiona,l but migration to v2 recommended.
• Post-upgrade banners: Use tctl alerts ack --ttl 48h to suppress false alerts.

Teleport confirms no Cloud Infrastructure or CI/CD systems were compromised.

Users must prioritize agent updates before the June 30 embargo lift, when full technical details will be disclosed.

The coordinated patch release underscores the criticality of maintaining zero-trust infrastructure integrity, with Teleport urging immediate action for self-managed environments.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates