CVE-2021-29435

trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials. The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.

• CWE-352

• https://github.com/TrestleAdmin/trestle-auth/commit/cb95b05cdb2609052207af07b4b8dfe3a23c11dcPatch, Third Party Advisory
• https://github.com/TrestleAdmin/trestle-auth/security/advisories/GHSA-h8hx-2c5r-32cfThird Party Advisory
• https://rubygems.org/gems/trestle-authProduct, Third Party Advisory
• https://github.com/TrestleAdmin/trestle-auth/commit/cb95b05cdb2609052207af07b4b8dfe3a23c11dcPatch, Third Party Advisory
• https://github.com/TrestleAdmin/trestle-auth/security/advisories/GHSA-h8hx-2c5r-32cfThird Party Advisory
• https://rubygems.org/gems/trestle-authProduct, Third Party Advisory

Published

Apr 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29429In Gradle before version 7.0, files created with open permis…5.5
• CVE-2021-29430Sydent is a reference Matrix identity server. Sydent does no…7.5
• CVE-2021-29431Sydent is a reference Matrix identity server. Sydent can be …6.5
• CVE-2021-29432Sydent is a reference matrix identity server. A malicious us…5.7
• CVE-2021-29433Sydent is a reference Matrix identity server. In Sydent vers…4.3
• CVE-2021-29434Wagtail is a Django content management system. In affected v…4.8
• CVE-2021-29436Anuko Time Tracker is an open source, web-based time trackin…8.1
• CVE-2021-29437ScratchOAuth2 is an Oauth implementation for Scratch. Any Sc…6.8
• CVE-2021-29438The Nextcloud dialogs library (npm package @nextcloud/dialog…5.4
• CVE-2021-29439The Grav admin plugin prior to version 1.10.11 does not corr…7.2
• CVE-2021-29440Grav is a file based Web-platform. Twig processing of static…7.2
• CVE-2021-29441Nacos is a platform designed for dynamic service discovery a…9.8