Extreme Networks Platform One Cross-Tenant Data Exposure Vulnerability

A race condition has been identified in the Extreme Platform One IAM Gateway API-key authentication process. Under specific high-concurrency traffic conditions, this vulnerability could intermittently allow requests authenticated with an Extreme Platform One/IAM-issued API key to access response data intended for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform One/Common Services API paths. Notably, XIQ-native tokens and standard OAuth/Bearer JWT authentication were not impacted.

Impact

Exploitation of this vulnerability could lead to unauthorized cross-tenant data exposure, allowing one tenant to access data belonging to another tenant.

Remediation

Users can upgrade to Extreme Platform One version 25.10.0-104 or later to address this vulnerability.