Critical · published September 16, 2025
🚨 An empty keystore opens the door wide! A crafty attacker can bypass authentication in Control-M/Agent versions 9.0.18 to 9.0.20 using only a demo certificate. 🔥 Think of the Control-M/Agent like a VIP club that lets in anyone with a free pass. If the club’s front desk doesn’t check the validity of that pass, anyone can stroll in and act like they own the place, which is exactly what happens when default keystores are used. An attacker could waltz right in unnoticed, gaining unauthorized access to the Control-M/Agent system. This could lead to data manipulation, unapproved actions, or even a full takeover of the system, which could be absolutely devastating for your organization!
Think of the Control-M/Agent like a VIP club that lets in anyone with a free pass. If the club’s front desk doesn’t check the validity of that pass, anyone can stroll in and act like they own the place, which is exactly what happens when default keystores are used. This vulnerability allows remote attackers with access to a signed third-party or demo certificate to authenticate without needing a valid certificate from the organization's certificate authority. The hardcoded fallback certificates, which are expired, only become relevant when using an empty kdb keystore.
An attacker could waltz right in unnoticed, gaining unauthorized access to the Control-M/Agent system. This could lead to data manipulation, unapproved actions, or even a full takeover of the system, which could be absolutely devastating for your organization! Immediately patch to a supported version of Control-M/Agent, ensuring that keystores are properly configured and not left empty or using defaults. Review and replace any expired trusted certificates as necessary to strengthen security. 🛡️ You've got this! Follow these steps to shore up your defenses and keep your systems safe. 💪✨