{"id":"CVE-2026-125285","kind":"vulnerability","aliases":["CVE-2026-125285"],"related":[],"title":"TIBCO Platform Self-Hosted Control Plane: authentication bypass via alternate path","description":"Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane.\n\nThis issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.","summary":"TIBCO Platform's Self-Hosted Control Plane, versions 1 through 1.21, has an authentication bypass through an alternate path or channel. An attacker who reaches the control plane may get access without valid credentials.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TIBCO Platform Self-Hosted Control Plane","fixed":[],"affected":"<= 1.21","ecosystem":"vendor"}],"ecosystems":[],"tags":["kubernetes","self-hosted","tibco","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the installed self-hosted TIBCO Control Plane version (the tibco-cp-base Helm chart / Control Plane release shown in the Platform Console). 1.21 and earlier are listed as affected by TIBCO. Fixed version not yet confirmed: read the Solution section of TIBCO's advisory CVE-2026-125285 at community.tibco.com/advisories/.","fix":null,"status":"open","published_at":"2026-11-12T13:17:15+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","triaged_at":"2026-11-12T13:38:42+00:00","updated_at":"2026-11-12T13:40:03+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-12T13:38:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"TIBCO Platform Self-Hosted Control Plane: authentication bypass via alternate path","impact":"high","summary":"TIBCO Platform's Self-Hosted Control Plane, versions 1 through 1.21, has an authentication bypass through an alternate path or channel. An attacker who reaches the control plane may get access without valid credentials.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["tibco","self-hosted","kubernetes"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker bypasses authentication and reaches control plane administration functions","analyst_note":"Confirm the fixed version and affected deployment conditions from the TIBCO advisory; the NVD entry gives only the range 1 through 1.21.","how_to_check":"- Check the installed TIBCO Platform Self-Hosted Control Plane version against the affected range (1 through 1.21).\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"TIBCO Platform Self-Hosted Control Plane","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams running TIBCO Platform's Self-Hosted Control Plane at versions 1 through 1.21 are exposed. The sources do not say which deployment settings or network exposure make it reachable, so unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4551,"output_tokens":556,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and affected deployment conditions from the TIBCO advisory; the NVD entry gives only the range 1 through 1.21.","search":"'-125285':15A,18A '-2026':14A,17A '1':41B,98C '1.21':43B,100C 'access':63B 'affect':88C 'altern':11A,50B,71C 'attack':55B 'authent':8A,46B,67C 'bypass':9A,47B,68C 'channel':53B,74C 'control':6A,24A,38B,59B,84C,95C 'credenti':66B 'cve':13A,16A 'get':62B 'host':5A,29B,37B,83C,94C 'hosted':23A 'issu':87C 'kubernet':26B 'may':61B 'path':12A,51B,72C 'plane':7A,25A,39B,60B,85C,96C 'platform':2A,20A,33B,79C,90C 'reach':57B 'self':4A,22A,28B,36B,82C,93C 'self-host':3A,27B,35B,81C,92C 'self-hosted':21A 'tibco':1A,19A,30B,32B,77C,78C,89C 'use':69C 'valid':65B 'vendor':31B 'version':40B 'via':10A 'vulner':75C 'without':64B","nicknames":[],"mitigations":[],"who_affected":"Teams running TIBCO Platform's Self-Hosted Control Plane at versions 1 through 1.21 are exposed. The sources do not say which deployment settings or network exposure make it reachable, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["platformselfhostedcontrolplane","tibcoplatformselfhostedcontrolplane"],"ptokens":["control","hosted","plane","platform","self","tibco"],"labels":["high","kubernetes","selfhosted","tibco","vendor"],"campaign_type":null,"search_a":"'-125285':15A,18A '-2026':14A,17A 'altern':11A 'authent':8A 'bypass':9A 'control':6A,24A 'cve':13A,16A 'host':5A 'hosted':23A 'path':12A 'plane':7A,25A 'platform':2A,20A 'self':4A,22A 'self-host':3A 'self-hosted':21A 'tibco':1A,19A 'via':10A","search_b":"'1':41B '1.21':43B 'access':63B 'altern':50B 'attack':55B 'authent':46B 'bypass':47B 'channel':53B 'control':38B,59B 'credenti':66B 'get':62B 'host':29B,37B 'kubernet':26B 'may':61B 'path':51B 'plane':39B,60B 'platform':33B 'reach':57B 'self':28B,36B 'self-host':27B,35B 'tibco':30B,32B 'valid':65B 'vendor':31B 'version':40B 'without':64B","search_c":"'1':98C '1.21':100C 'affect':88C 'altern':71C 'authent':67C 'bypass':68C 'channel':74C 'control':84C,95C 'host':83C,94C 'issu':87C 'path':72C 'plane':85C,96C 'platform':79C,90C 'self':82C,93C 'self-host':81C,92C 'tibco':77C,78C,89C 'use':69C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@tibco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125285","severity":null,"published_at":"2026-11-12T13:17:15+00:00","modified_at":"2026-11-12T13:17:15+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","fetched_at":"2026-11-12T13:38:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125285:3736","url":"https://community.tibco.com/advisories/","severity":null,"published_at":"2026-11-12T13:40:03+00:00","modified_at":"2026-11-12T13:40:03+00:00","first_seen_at":"2026-11-12T13:40:03+00:00","fetched_at":"2026-11-12T13:40:03+00:00","note":"TIBCO advisory (community.tibco.com listing excerpt) confirms product/affected range 'TIBCO Platform 1.21 and prior'; the full advisory body with solution not readable, so fixed version unknown. Nothing verified.","cites":["https://community.tibco.com/advisories/"]}],"documents":[{"id":134880,"url":"https://community.tibco.com/advisories/","title":"TIBCO Security Advisory: November 12, 2026 - TIBCO Platform - CVE-2026-125285 (listing excerpt)","kind":"advisory","source":"analyst","publisher":null,"text":"TIBCO Platform's Self-Hosted Control Plane - Authentication Bypass Vulnerability. Original release date: November 12, 2026. Description: A vulnerability has been discovered in TIBCO Platform's self-hosted TIBCO Control Plane. Product(s) Affected: TIBCO Platform 1.21 and prior versions. (Listing excerpt truncated; solution section not visible.)","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}