CVE-2025-31484: conda-forge infrastructure uses a bad token for Azure's cf-staging access
conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a package to the conda-forge channel, bypassing our feedstock-token + upload process. The security logs on anaconda.org were check for any packages that were not copied from the cf-staging to the conda-forge channel and none were found.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31484?
CVE-2025-31484 is considered a high-severity vulnerability due to the potential unauthorized access it allows to feedstock maintainers.
How do I fix CVE-2025-31484?
To fix CVE-2025-31484, ensure that you update the conda-forge infrastructure to the latest version post April 01, 2025.
What are the potential impacts of CVE-2025-31484?
The impact of CVE-2025-31484 includes possible unauthorized code changes and configuration access by feedstock maintainers.
Who is affected by CVE-2025-31484?
CVE-2025-31484 affects all users and maintainers of the conda-forge infrastructure between February 10, 2025, and April 01, 2025.
Is there an exploit public for CVE-2025-31484?
As of now, there is no confirmed public exploit for CVE-2025-31484, but the vulnerability itself poses significant security risks.