CVE-2025-46548: Apache Pekko Management Auth Bypass Flaw

CVE-2025-46548 Overview

CVE-2025-46548 is an authentication bypass vulnerability [CWE-287] in Apache Pekko Management and Akka Management. When developers enable Basic Authentication using the Java Domain-Specific Language (DSL), the authenticator is not properly applied to incoming Management API requests. Unauthenticated attackers on the network can reach protected Management API endpoints without providing credentials.

The issue affects Apache Pekko Management versions prior to 1.1.1 and Akka Management versions prior to 1.6.1. The vulnerability received a CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Critical Impact
Attackers can reach Management API endpoints intended to be protected by Basic Authentication, exposing cluster management operations and sensitive runtime information.

Affected Products

Apache Pekko Management versions prior to 1.1.1
Akka Management versions prior to 1.6.1
Applications using the Java DSL to configure Basic Authentication on Pekko/Akka Management

Discovery Timeline

2025-06-03 - CVE-2025-46548 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46548

Vulnerability Analysis

Apache Pekko Management and Akka Management expose HTTP endpoints for cluster operations, health checks, and runtime introspection. Operators can protect these endpoints by wrapping route handlers with a Basic Authentication authenticator. The Java DSL binding for this feature does not correctly attach the authenticator to the underlying route directive.

As a result, the Management API accepts requests without validating the Authorization header. Attackers reaching the Management API port receive responses as if authentication had succeeded. The exposure applies only to deployments that rely on Pekko/Akka's built-in Basic Authentication rather than network-level restrictions.

The vulnerability is exploitable over the network with low attack complexity and no user interaction. Impact covers confidentiality and integrity but not availability, as attackers can read management data and invoke management operations exposed by the API.

Root Cause

The root cause is an implementation defect in the Java DSL bridge for authentication directives. The Java-facing API failed to propagate the supplied authenticator function into the Scala route pipeline. The fix restores the correct wiring so the authenticator executes before route handlers process requests. Details are available in the Pekko Management pull request and the Akka Management pull request.

Attack Vector

An attacker with network access to the Management API port sends HTTP requests directly to management endpoints. No credentials, tokens, or prior access are required. Because the authenticator is not applied, the request bypasses the Basic Authentication check entirely and reaches the protected route. Exploitation requires only a standard HTTP client and knowledge of the exposed management endpoints. See the Apache mailing list advisory for vendor details.

Detection Methods for CVE-2025-46548

Indicators of Compromise

HTTP requests to Pekko/Akka Management endpoints without an Authorization: Basic header receiving 200 OK responses
Access log entries showing successful requests to /cluster/members, /cluster/shards, or /health from unexpected source IPs
Management API activity originating from addresses outside the operator or orchestration subnets

Detection Strategies

Enable and centralize access logs for the Management API HTTP listener and alert on 2xx responses missing authentication headers
Inventory running applications and identify Pekko Management versions below 1.1.1 and Akka Management versions below 1.6.1
Review application configuration to confirm whether Basic Authentication is enabled through the Java DSL rather than the Scala DSL

Monitoring Recommendations

Monitor network traffic to Management API ports for connections originating outside trusted management networks
Track invocations of cluster mutation endpoints and correlate them with authenticated identity records
Alert on new external listeners bound to the Management API port after deployment changes

How to Mitigate CVE-2025-46548

Immediate Actions Required

Upgrade Apache Pekko Management to version 1.1.1 or later
Upgrade Akka Management to version 1.6.1 or later
Restrict Management API ports to trusted networks using firewall rules or Kubernetes NetworkPolicies until upgrades are complete
Rotate any credentials or secrets that may have been exposed through the Management API

Patch Information

Apache released the fix for Pekko Management in version 1.1.1, and Lightbend released the fix for Akka Management in version 1.6.1. The patches correctly propagate the Java DSL authenticator into the underlying route pipeline. See the Pekko Management fix and Akka Management fix for implementation details.

Workarounds

Bind the Management API to a loopback interface or internal-only network segment
Place the Management API behind a reverse proxy that enforces authentication independently
Replace the Java DSL authentication configuration with the Scala DSL equivalent until patches can be deployed
Use network access control lists to allow Management API traffic only from operator jump hosts

bash

# Example: restrict Pekko Management port with iptables until patched
iptables -A INPUT -p tcp --dport 8558 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8558 -j DROP