Yeti-platform Yeti vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Yeti-platform Yeti: 3 record(s), with affected versions and fixes.
cpe:2.3:a:yeti-platform:yeti

CVE-2026-92783 High · 8.1 CWE-862 Sep 16, 2026

Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.

CVE-2024-46508 High · 7.5 CWE-798 May 8, 2026

Use of Hard-coded Credentials in Yeti-platform Yeti

yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).

CVE-2024-46507 High · 7.3 Public exploit CWE-94 May 8, 2026

Code Injection in Yeti-platform Yeti

A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.