Is CVE-2025-13807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13807 being exploited in the wild.

How severe is CVE-2025-13807?

Medium severity, with a CVSS score of 4.3, published 1 December 2025.

Which products and versions are affected?

Orionsec Orion-Ops up to commit 5925824997a3109651bbde07460958a7be249ed1.

Is there a fix for CVE-2025-13807?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13807 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-13807?

Check whether you run Orionsec Orion-Ops at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13807: OrionSec Orion-ops improper authorization in MachineKeyController

CVE-2025-13807 · Severity: medium · CVSS 4.3 · Published 2025-12-01

Orion-ops is a server-based infrastructure operations and key management system used to store and manage SSH private keys for administrative access to servers. A flaw in the API authorization logic allows any authenticated user to bypass access controls and download all stored SSH private keys, potentially granting attackers complete access to managed infrastructure and sensitive systems.

Technologies: Orionsec Orion-Ops. Vendors: Orionsec.

Quick answers

Is CVE-2025-13807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13807 being exploited in the wild.
How severe is CVE-2025-13807?: Medium severity, with a CVSS score of 4.3, published 1 December 2025.
Which products and versions are affected?: Orionsec Orion-Ops up to commit 5925824997a3109651bbde07460958a7be249ed1.
Is there a fix for CVE-2025-13807?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13807 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-13807?: Check whether you run Orionsec Orion-Ops at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authorization flaw (CWE-285) in the MachineKeyController REST API endpoints. The affected endpoints (POST /orion/api/machine-key/list, /machine-key/detail, and /file-download/token) lack role-based access control (@RequireRole) enforcement, allowing any logged-in user to enumerate SSH key IDs and retrieve internal file paths. The FileDownloadServiceImpl#getDownloadToken function issues download tokens without verifying ownership—storing only the requester's user ID in Redis without revalidation—enabling low-privileged accounts to download SSH private keys uploaded by administrators. Attack requires only a valid login session and network access to the API; no additional authentication is needed once authenticated. The exploit is public and no official patch has been released.

Affected products

OrionSec Orion-ops up to commit 5925824997a3109651bbde07460958a7be249ed1

Timeline

2025-12-01: disclosed: Vulnerability disclosed publicly
2025-12-01: exploited: Exploit code released publicly

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.