CVE-2025-5409 is a High severity improper access control flaw (CVSS 7.3) in Mist Community Edition up to 4.7.1. The create_token function in the API token handler does not enforce access properly. Upgrade to 4.7.2, which fixes it, and then review existing tokens.
What's affected
The record says versions up to 4.7.1 are affected, and that upgrading to 4.7.2 addresses the issue. The patch identifier is db10ecb62ac832c1ed4924556d167efb9bc07fad in the mist.api repository.
The affected function is create_token in src/mist/api/auth/views.py, part of the API token handler. The record says the attack can be launched remotely and that an exploit has been disclosed publicly.
An API token is a standing credential, so a flaw in the function that creates tokens is worth more than its score suggests.
How to check if you're exposed
Find the version of your Mist Community Edition deployment. If you run from release images or source, check the tag you use:
docker ps --format "table {{.Names}}\t{{.Image}}" | grep -i mist
Any version up to 4.7.1 is affected. Then open the token list in the Mist interface, or query it through the API, and compare it with the tokens you expect. Look for tokens with names or creation times that nobody on the team can explain.
What to do now
- Upgrade Mist Community Edition to 4.7.2 or later.
- List all API tokens and revoke any that you cannot match to a person and a purpose.
- Rotate credentials for the cloud providers connected to Mist if you find suspicious tokens.
- Restrict network access to the Mist API to trusted ranges while you work through the review.
- Check the logs of connected cloud accounts for actions you did not expect during the period before the upgrade.
Why it matters
The record lists CWE-284 (improper access control) and CWE-266 (incorrect privilege assignment). An API token is a key, and the function that makes keys must check strongly who is asking and for whom the key is made. When that check is weak, a person can obtain access that was never meant for them.
This kind of flaw is easy to miss in testing, since the feature works as designed for honest users. It only shows up when someone asks for something they should not be allowed to have.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The record says the exploit has been disclosed publicly, so waiting is a poor option.
Quick check
What should I do about tokens made before the upgrade?
Review them. The upgrade stops new misuse of the function, but it does not remove a token that someone already created. Revoke any you cannot account for.
Is there a fixed version?
Yes. The record says upgrading to 4.7.2 addresses the issue, and names the patch commit.
Sources
Last reviewed: 18 October 2026.
