CVE-2025-32377: Rasa Pro Auth Bypass Vulnerability

CVE-2025-32377 Overview

CVE-2025-32377 is a missing authentication vulnerability [CWE-306] in Rasa Pro, a framework for building conversational AI assistants that integrate large language models (LLMs). The voice connectors in Rasa Pro fail to enforce authentication even when a token is configured in the credentials.yml file. Attackers can submit voice data to the Rasa Pro assistant from unauthenticated sources over the network. The vendor patched the audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7, and 3.12.6.

Critical Impact
Unauthenticated network attackers can submit voice data to Rasa Pro assistants, bypassing the token authentication configured in credentials.yml and affecting integrity and availability of conversational AI workflows.

Affected Products

Rasa Pro versions prior to 3.9.20 (3.9.x branch)
Rasa Pro versions prior to 3.10.19, 3.11.7, and 3.12.6
Rasa Pro audiocodes, audiocodes_stream, and genesys voice connectors

Discovery Timeline

2025-04-18 - CVE-2025-32377 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32377

Vulnerability Analysis

The vulnerability affects voice connector components in Rasa Pro that expose HTTP endpoints for third-party voice platforms. Operators configure a shared token in credentials.yml expecting the connector to validate that token on every inbound request. The connectors do not enforce this check, so any network client reaching the connector endpoint can deliver voice payloads. The result is unauthenticated access to a conversational AI processing pipeline that would otherwise sit behind a token gate.

The issue is limited to integrity and availability impact on the assistant. Attackers can inject arbitrary voice content into sessions, trigger downstream LLM processing, and consume compute or third-party API budgets tied to the assistant.

Root Cause

The root cause is a missing authentication check [CWE-306] in the request-handling paths of the audiocodes, audiocodes_stream, and genesys voice connectors. The token loaded from credentials.yml is not compared against the credentials presented by inbound callers before the request is processed.

Attack Vector

An unauthenticated attacker sends crafted voice or webhook requests over the network to the exposed Rasa Pro voice connector endpoint. No user interaction or prior privileges are required. Because token validation is skipped, the assistant processes the request as if it came from a trusted voice platform, allowing injection of arbitrary voice data into conversations. Refer to the GitHub Security Advisory for the vendor description.

Detection Methods for CVE-2025-32377

Indicators of Compromise

Inbound requests to Rasa Pro voice connector endpoints (/webhooks/audiocodes/*, /webhooks/genesys/*) from source IPs outside the approved voice platform ranges.
Requests to voice connector endpoints missing the expected token header or bearing an incorrect token, yet still returning success responses.
Unexpected spikes in LLM or speech-processing API usage tied to the Rasa Pro deployment.

Detection Strategies

Review application and reverse-proxy logs for requests to voice connector paths that do not originate from configured voice platform CIDR ranges.
Correlate conversation IDs and session identifiers with upstream voice platform records to identify sessions with no matching provider-side call.
Baseline normal request volumes per connector and alert on deviations that could indicate abuse.

Monitoring Recommendations

Instrument the reverse proxy or ingress in front of Rasa Pro to log the presence and value of the authentication token header.
Forward Rasa Pro access logs to a centralized log platform and alert on unauthenticated hits to /webhooks/audiocodes* and /webhooks/genesys*.
Monitor egress traffic from the Rasa Pro host to LLM providers for volume anomalies that could indicate injected traffic.

How to Mitigate CVE-2025-32377

Immediate Actions Required

Upgrade Rasa Pro to a patched release: 3.9.20, 3.10.19, 3.11.7, or 3.12.6, matching your current branch.
Restrict network access to voice connector endpoints so only trusted voice platform IP ranges can reach them.
Rotate any shared tokens configured in credentials.yml after upgrading, since prior tokens may have been exposed to unauthenticated traffic.

Patch Information

Rasa published fixes for the audiocodes, audiocodes_stream, and genesys connectors in Rasa Pro 3.9.20, 3.10.19, 3.11.7, and 3.12.6. Patched versions enforce the token configured in credentials.yml on inbound voice connector requests. Full details are available in the GitHub Security Advisory GHSA-7xq5-54jp-2mfg.

Workarounds

Place the Rasa Pro voice connectors behind a reverse proxy that enforces authentication and IP allowlisting before requests reach the application.
Disable the audiocodes, audiocodes_stream, and genesys connectors in credentials.yml if they are not required for production use.
Terminate voice platform traffic on a network segment reachable only through a VPN or private link to the voice provider.

bash

# Configuration example: upgrade Rasa Pro to a patched version
pip install --upgrade "rasa-pro==3.12.6"

# Verify installed version
python -c "import rasa; print(rasa.__version__)"