CVE-2021-32635

Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint. An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container. Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint. The vulnerability is patched in Singularity version 3.7.4. Two possible workarounds exist: Users can only interact with the default remote endpoint, or an installation can have an execution control list configured to restrict execution to containers signed with specific secure keys.

• CWE-20
• CWE-923

• https://github.com/sylabs/singularity/releases/tag/v3.7.4Third Party Advisory
• https://github.com/sylabs/singularity/security/advisories/GHSA-5mv9-q7fq-9394Third Party Advisory
• https://security.gentoo.org/glsa/202107-50Third Party Advisory
• https://github.com/sylabs/singularity/releases/tag/v3.7.4Third Party Advisory
• https://github.com/sylabs/singularity/security/advisories/GHSA-5mv9-q7fq-9394Third Party Advisory
• https://security.gentoo.org/glsa/202107-50Third Party Advisory

Published

May 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32629Cranelift is an open-source code generator maintained by Byt…8.8
• CVE-2021-32630Admidio is a free, open source user management system for we…8.8
• CVE-2021-32631Common is a package of common modules that can be accessed b…6.5
• CVE-2021-32632Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 a…4.3
• CVE-2021-32633Zope is an open-source web application server. In Zope versi…8.8
• CVE-2021-32634Emissary is a distributed, peer-to-peer, data-driven workflo…7.2
• CVE-2021-32637Authelia is a a single sign-on multi-factor portal for web a…10
• CVE-2021-32638Github's CodeQL action is provided to run CodeQL-based code …4.4
• CVE-2021-32639Emissary is a P2P-based, data-driven workflow engine. Emissa…9.9
• CVE-2021-3264SQL Injection vulnerability in cxuucms 3.1 ivia the pid para…7.2
• CVE-2021-32640ws is an open source WebSocket client and server library for…5.3
• CVE-2021-32641auth0-lock is Auth0's signin solution. Versions of nauth0-lo…6.1