CVE-2025-54126: WAMR Auth Bypass Vulnerability Explained

CVE-2025-54126 Overview

CVE-2025-54126 affects the WebAssembly Micro Runtime (WAMR) iwasm package, the executable binary built from WAMR VMcore that supports the WebAssembly System Interface (WASI) and a command line interface. In versions 2.4.0 and below, iwasm accepts an IPv4 address supplied to --addr-pool without a subnet mask and treats the entry as matching all IP addresses. This weakens the network access restriction the flag is intended to enforce [CWE-668]. Services that rely on --addr-pool to limit inbound connections may become reachable from any source. The Bytecode Alliance fixed the issue in WAMR 2.4.1.

Critical Impact
Access control lists configured through --addr-pool without an explicit CIDR mask silently permit all IP addresses, exposing WASI-enabled services to unauthorized network connections.

Affected Products

Bytecode Alliance WebAssembly Micro Runtime (WAMR) versions 2.4.0 and below
iwasm command line binary built from affected WAMR VMcore
WASI-enabled workloads using --addr-pool for network access restriction

Discovery Timeline

2025-07-29 - CVE-2025-54126 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54126

Vulnerability Analysis

The iwasm binary parses --addr-pool entries expected in Classless Inter-Domain Routing (CIDR) notation, for example 192.168.1.0/24. The parser splits each entry on / to extract the address and the mask. In vulnerable releases, a missing mask defaulted to 0, which corresponds to a /0 prefix and matches every possible IPv4 address. Operators supplying --addr-pool=10.0.0.5 expected only that host to be allowed, but the runtime silently permitted all incoming connections. The flaw undermines the isolation model WAMR advertises for WASI networking and can transform an intentionally restricted deployment into an open service. Because the misconfiguration produces no warning, operators have no signal that the allowlist is ineffective.

Root Cause

The parsing logic in core/iwasm/common/wasm_runtime_common.c used the expression mask ? atoi(mask) : 0 when inserting entries into the address pool. A missing mask therefore mapped to the prefix length 0, which the pool matcher interprets as matching any address. The runtime did not validate that the caller supplied a mask, nor did it reject malformed entries.

Attack Vector

An attacker on any network reachable to the host can connect to a WASI service whose operator configured --addr-pool without a CIDR mask. No authentication, privileges, or user interaction are required. The exposure applies to any TCP or UDP endpoint the WebAssembly module binds, so the impact scales with the sensitivity of the hosted workload.

// Patch: core/iwasm/common/wasm_runtime_common.c
        address = strtok(cp, "/");
        mask = strtok(NULL, "/");

-        ret = addr_pool_insert(apool, address, (uint8)(mask ? atoi(mask) : 0));
+        if (!mask) {
+            snprintf(error_buf, error_buf_size,
+                     "Invalid address pool entry: %s, must be in the format of "
+                     "ADDRESS/MASK",
+                     addr_pool[i]);
+            goto fail;
+        }
+
+        ret = addr_pool_insert(apool, address, (uint8)atoi(mask));
        wasm_runtime_free(cp);

Source: Bytecode Alliance commit 121232a. The fix rejects any --addr-pool entry that lacks an explicit mask and returns a descriptive error.

Detection Methods for CVE-2025-54126

Indicators of Compromise

Inbound network connections to WASI services from IP ranges outside the intended allowlist
iwasm process command lines containing --addr-pool values without a / mask suffix
Unexpected socket activity originating from WebAssembly modules on production hosts

Detection Strategies

Audit running iwasm processes and inspect the --addr-pool arguments for entries missing CIDR masks.
Compare deployment manifests, container specs, and systemd units against the WAMR 2.4.1 CIDR requirement.
Correlate WAMR version strings with the fixed release WAMR-2.4.1 across your inventory.

Monitoring Recommendations

Log and alert on connections to WASI-exposed ports from source addresses outside expected subnets.
Track WAMR runtime version metadata in software bills of materials and CI pipelines.
Add configuration linting to reject --addr-pool values that omit /mask before deployment.

How to Mitigate CVE-2025-54126

Immediate Actions Required

Upgrade WAMR and iwasm to version 2.4.1 or later on all hosts.
Rewrite every --addr-pool entry to include an explicit CIDR mask, for example 10.0.0.5/32 for a single host.
Place vulnerable iwasm deployments behind an external firewall or reverse proxy until patched.

Patch Information

The fix is available in WAMR 2.4.1 and documented in GitHub Security Advisory GHSA-vh64-mfvw-pxqp. The upstream commit that introduces the validation is 121232a9.

Workarounds

Enforce network segmentation with host firewall rules such as iptables or nftables scoped to trusted source IPs.
Deploy iwasm inside a restricted network namespace that only exposes required peers.
Wrap iwasm startup scripts with a validator that fails when any --addr-pool argument omits /mask.

bash

# Configuration example: enforce CIDR notation on --addr-pool
# Correct usage after upgrading to WAMR 2.4.1
iwasm --addr-pool=10.0.0.5/32,192.168.10.0/24 module.wasm

# Vulnerable usage rejected by 2.4.1 (no mask)
# iwasm --addr-pool=10.0.0.5 module.wasm