CVE-2021-32634

Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-authenticated requests to the [`WorkSpaceClientEnqueue.action`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/WorkSpaceClientEnqueueAction.java) REST endpoint. This issue may lead to post-auth Remote Code Execution. This issue has been patched in version 6.5.0. As a workaround, one can disable network access to Emissary from untrusted sources.

• CWE-502

• https://github.com/NationalSecurityAgency/emissary/commit/40260b1ec1f76cc92361702cc14fa1e4388e19d7Patch, Third Party Advisory
• https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-m5qf-gfmp-7638Third Party Advisory
• https://github.com/NationalSecurityAgency/emissary/commit/40260b1ec1f76cc92361702cc14fa1e4388e19d7Patch, Third Party Advisory
• https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-m5qf-gfmp-7638Third Party Advisory

Published

May 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32628Redis is an open source, in-memory database that persists on…7.5
• CVE-2021-32629Cranelift is an open-source code generator maintained by Byt…8.8
• CVE-2021-32630Admidio is a free, open source user management system for we…8.8
• CVE-2021-32631Common is a package of common modules that can be accessed b…6.5
• CVE-2021-32632Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 a…4.3
• CVE-2021-32633Zope is an open-source web application server. In Zope versi…8.8
• CVE-2021-32635Singularity is an open source container platform. In verions…6.3
• CVE-2021-32637Authelia is a a single sign-on multi-factor portal for web a…10
• CVE-2021-32638Github's CodeQL action is provided to run CodeQL-based code …4.4
• CVE-2021-32639Emissary is a P2P-based, data-driven workflow engine. Emissa…9.9
• CVE-2021-3264SQL Injection vulnerability in cxuucms 3.1 ivia the pid para…7.2
• CVE-2021-32640ws is an open source WebSocket client and server library for…5.3