dbcve.org
Missing AuthorizationWeakness · CWE-862

CVE-2025-2298

HIGH · 8.4 CVSS v4.0 Published 2025-04-21
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
90/100
Remediation priority · Urgent
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the system has access to, including system files and files stored in remote locations such as S3, Azure Blob Storage, and local filesystems. This vulnerability exists due to insufficient access controls on an API endpoint, enabling any authenticated user to specify and delete files outside their intended scope. Exploiting this flaw could lead to data loss, denial of service (DoS), and potential escalation of impact depending on the deleted files. Affected versions: * Any version of Dremio below 24.0.0 * Dremio 24.3.0 - 24.3.16 * Dremio 25.0.0 - 25.0.14 * Dremio 25.1.0 - 25.1.7 * Dremio 25.2.0 - 25.2.4 Fixed in version:  * Dremio 24.3.17 and above * Dremio 25.0.15 and above * Dremio 25.1.8 and above * Dremio 25.2.5 and above * Dremio 26.0.0 and above

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Improper authorization vulnerability in Dremio allows any authenticated user to delete arbitrary files accessible to the system (local filesystem, S3, Azure Blob Storage) via an API endpoint lacking proper access controls, enabling data loss and potential DoS.

MitigationUpgrade Dremio to version 24.3.17+, 25.0.15+, 25.1.8+, 25.2.5+, or 26.0.0+; implement compensating controls (API access restrictions, network segmentation) until patching is feasible.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Dremio version
    Check the installed Dremio version by reviewing the Dremio metadata or running 'dremio --version' if CLI is available. Common installation paths include /opt/dremio or /usr/local/dremio. Check the dremio.conf file or package manager for version information.
    Affected if The installed version is 24.3.x before 24.3.17, 25.0.x before 25.0.15, 25.1.x before 25.1.8, 25.2.x before 25.2.5, or 25.3.0 through 25.x.x before the respective fixed versions, or any 26.0.x before 26.0.0.
  2. Confirm Dremio API is exposed
    Verify that the Dremio REST API endpoints are accessible from the network. Check the dremio.conf configuration file for the 'services' section and verify http.enabled or https.enabled settings, along with bind addresses. Determine if the API port (typically 9047 or 31010) is exposed externally.
    Affected if The Dremio API is accessible from untrusted networks or external IP addresses without proper firewall restrictions.
  3. Review file deletion API access controls
    Examine the Dremio configuration for authorization settings. Check whether the file deletion API endpoint enforces role-based access control (RBAC). Look at the services section in dremio.conf for any authentication or authorization settings related to file operations.
    Affected if RBAC for file deletion operations is not properly configured or the API endpoint does not validate user permissions before allowing file deletion.
  4. Audit logs for unauthorized file deletion
    Search Dremio query and audit logs for DELETE or REMOVE file operations. Check the /var/log/dremio/ directory or the configured log path for entries indicating file deletion commands. Look for operations targeting paths outside the user's expected sandbox or on system files.
    Affected if Logs show file deletion operations performed by users on files they should not have access to, including system files or files in other user's directories.

You are affected if your Dremio version falls within the vulnerable ranges AND the file deletion API is accessible to authenticated users without proper permission validation.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade Dremio to version 24.3.17+, 25.0.15+, 25.1.8+, 25.2.5+, or 26.0.0+; implement compensating controls (API access restrictions, network segmentation) until patching is feasible.

Recommended fix High confidence

Upgrade to Dremio 26.0.0 or the latest 25.x LTS version in your current branch (24.3.17+, 25.0.15+, 25.1.8+, or 25.2.5+)

  1. 1. Identify the current Dremio version by checking the Dremio console or running 'dremio --version' or checking the installed RPM/Docker tag
  2. 2. Determine which fixed version branch applies to your current installation (24.3.x -> 24.3.17+, 25.0.x -> 25.0.15+, 25.1.x -> 25.1.8+, 25.2.x -> 25.2.5+, or below 24.0.0 -> latest 26.x)
  3. 3. Review Dremio release notes for the target version to understand any migration requirements or configuration changes
  4. 4. Perform a full backup of Dremio configuration, metadata, and data catalog before upgrading
  5. 5. Stop the Dremio service gracefully
  6. 6. Upgrade Dremio to the target fixed version using your deployment method (RPM/DEB package, Docker, or cloud deployment)
  7. 7. Start the Dremio service and verify it runs successfully
  8. 8. Test that the authorization fix is working by verifying that users cannot delete files outside their authorized paths
Caveat Review Dremio release notes for breaking changes between your current version and target version; major version upgrades (e.g., 24.x to 25.x or 26.x) may require migration steps

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing10.0 h
  • Review / QA4.0 h
32.0 hours of engineering $5,580
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,928.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-2298 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-2298 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data