VMware Avi Load Balancer: authorization bypass exposes part of the Avi Controller control plane

Impact

A network-reachable actor holding low privileges can reach a limited subset of the Avi Control Plane without the authorization that should gate it. The Controller is what programs the service engines fronting inference endpoints, management portals and storage services, so unauthorized reach into it means visibility into how tenant traffic is steered and, per the vendor's own scoring, high impact to both confidentiality and integrity. The advisory does not enumerate which endpoints are exposed, so treat the blast radius as unknown rather than small. Load balancer configuration is one of the few places where one tenant's traffic policy sits next to another's.

Who can reach it

Anyone with network access to the Avi Controller and a low-privileged account on it - typically anyone on the management network. Not pre-authentication, but the bar is a limited user rather than an administrator.

What to do

Upgrade per the Broadcom advisory: 32.1.1 to 32.1.2, the 31.1.1-31.2.2 line to 31.2.2-2p3, and both the 30.1.1-30.2.6 and 22.1.1-22.1.7 lines to 30.2.7. This is a Controller-cluster upgrade, planned as a management-plane maintenance window; the advisory does not describe a configuration-only workaround, so restricting Controller reachability to the management VLAN is the interim step, not a substitute.

References