CVE-2021-43832: Improper Access Control in spinnaker
Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup Role-based access control (RBAC) with-in spinnaker, this enables remote execution and access to deploy almost any resources on any account. Patches are available on the latest releases of the supported branches and users are advised to upgrade as soon as possible. Users unable to upgrade should enable RBAC on ALL accounts and applications. This mitigates the ability of a pipeline to affect any accounts. Block application access unless permission are enabled. Users should make sure ALL application creation is restricted via appropriate wildcards.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-43832?
CVE-2021-43832 is a vulnerability in Spinnaker, an open source multi-cloud continuous delivery platform, that allows arbitrary users to create and execute pipelines without authentication.
How severe is CVE-2021-43832?
CVE-2021-43832 has a severity rating of 9.8 out of 10, which indicates a critical vulnerability.
What software versions are affected by CVE-2021-43832?
CVE-2021-43832 affects Spinnaker versions up to and including 1.25.8, as well as versions from 1.26.0 to 1.26.7.
How can I fix CVE-2021-43832?
To fix CVE-2021-43832, users should update their Spinnaker installation to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2021-43832?
More information about CVE-2021-43832 can be found at the following reference: [GitHub Advisory](https://github.com/spinnaker/spinnaker/security/advisories/GHSA-9h7c-rfrp-gvgp)