Executive brief
Akana API Platform's Policy Manager console is vulnerable to unauthenticated remote code execution. An attacker can craft a malicious request that bypasses authentication protections and reaches an endpoint capable of executing arbitrary code, potentially allowing complete compromise of the API management system and any APIs it controls.
Technical details
The vulnerability stems from a path normalization discrepancy between the authentication filter and the servlet dispatcher in the Policy Manager console. An attacker can craft a specially formatted request that appears legitimate to the authentication filter but is interpreted differently by the servlet dispatcher, allowing the request to bypass authentication checks. Once authenticated checks are bypassed, the request reaches an endpoint that evaluates attacker-supplied script code without sandboxing protections, enabling arbitrary code execution with the privileges of the application server. No authentication credentials or user interaction is required for exploitation.
Affected products
- Perforce Akana API Platform
Timeline
- 2026-09-09: disclosed