CVE-2025-29315: OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request

March 24, 2025 (updated March 26, 2025)

An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to execute privileged operations via a crafted request.

References

blog.csdn.net/weixin_43959580/article/details/144794289
github.com/advisories/GHSA-x65v-g96x-c6gw
github.com/opendaylight/sfc
nvd.nist.gov/vuln/detail/CVE-2025-29315

Code Behaviors & Features

Detect and mitigate CVE-2025-29315 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →