CVE-2020-11091

In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it's pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them. By sending rogue router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year's RCE in apt (CVE-2019-3462), you can now escalate to the host. Weave Net version 2.6.3 disables the accept_ra option on the veth devices that it creates.

• CWE-350

• https://github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60Patch, Third Party Advisory
• https://github.com/weaveworks/weave/security/advisories/GHSA-59qg-grp7-5r73Third Party Advisory
• https://github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60Patch, Third Party Advisory
• https://github.com/weaveworks/weave/security/advisories/GHSA-59qg-grp7-5r73Third Party Advisory

Published

Jun 3, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11086In FreeRDP less than or equal to 2.0.0, there is an out-of-b…5.4
• CVE-2020-11087In FreeRDP less than or equal to 2.0.0, there is an out-of-b…5.4
• CVE-2020-11088In FreeRDP less than or equal to 2.0.0, there is an out-of-b…5.4
• CVE-2020-11089In FreeRDP before 2.1.0, there is an out-of-bound read in ir…5.5
• CVE-2020-1109An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11090In Indy Node 1.12.2, there is an Uncontrolled Resource Consu…7.5
• CVE-2020-11093Hyperledger Indy Node is the server portion of a distributed…7.5
• CVE-2020-11094The October CMS debugbar plugin before version 3.1.0 contain…9.8
• CVE-2020-11095In FreeRDP before version 2.1.2, an out of bound reads occur…5.4
• CVE-2020-11096In FreeRDP before version 2.1.2, there is a global OOB read …6.5
• CVE-2020-11097In FreeRDP before version 2.1.2, an out of bounds read occur…5.4
• CVE-2020-11098In FreeRDP before version 2.1.2, there is an out-of-bound re…6.5