Is CVE-2026-63482 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63482 being exploited in the wild.

How severe is CVE-2026-63482?

High severity, with a CVSS score of 7.5, published 3 November 2026.

Is there a fix for CVE-2026-63482?

Yes: fixed in 2.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63482 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63482?

Check whether you run Yeti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63482: Yeti unauthenticated audit trail access in API

CVE-2026-63482 · Severity: high · CVSS 7.5 · Published 2026-11-03

Yeti is a threat intelligence and forensics platform used by security analysts to manage and investigate indicators and objects. Prior to version 2.5.1, an unauthenticated attacker on the network could access the complete audit trail of all intelligence objects through an unprotected API endpoint, exposing sensitive operational history including analyst usernames, target identifiers, and records of all create/update/delete actions performed on the platform.

Technologies: Yeti. Vendors: Yeti.

Quick answers

Is CVE-2026-63482 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63482 being exploited in the wild.
How severe is CVE-2026-63482?: High severity, with a CVSS score of 7.5, published 3 November 2026.
Which products and versions are affected?: Yeti prior to 2.5.1.
Is there a fix for CVE-2026-63482?: Yes: fixed in 2.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63482 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63482?: Check whether you run Yeti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.5.1

Technical details

The /api/v2/audit/timeline/{id} endpoint in Yeti's audit router was registered without an authentication dependency, allowing unauthenticated network access to TimelineLog records. The vulnerability exists because the audit router lacks the Depends(auth.get_current_active_user) dependency that other routers in the application enforce. An attacker can query the audit endpoint with empty, partial, or wildcard paths to retrieve actor usernames, target IDs, actions, and before-and-after object data, fully exposing the operational history of threat-intelligence objects.

Affected products

Yeti Yeti prior to 2.5.1

Timeline

2026-11-03: disclosed: CVE-2026-63482 published
2026-07-01: patched: Fix merged in commit 692af02

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.