CVE-2021-3917

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

• CWE-276
• CWE-276

• https://access.redhat.com/security/cve/CVE-2021-3917Patch, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2018478Issue Tracking, Vendor Advisory
• https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0cPatch, Third Party Advisory
• https://github.com/coreos/fedora-coreos-tracker/issues/889Issue Tracking, Patch, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2021-3917Patch, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2018478Issue Tracking, Vendor Advisory
• https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0cPatch, Third Party Advisory
• https://github.com/coreos/fedora-coreos-tracker/issues/889Issue Tracking, Patch, Third Party Advisory

Published

Aug 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39164Matrix is an ecosystem for open federated Instant Messaging …3.1
• CVE-2021-39165Cachet is an open source status page. With Cachet prior to a…6.5
• CVE-2021-39166Pimcore is an open source data & experience management platf…5.4
• CVE-2021-39167OpenZepplin is a library for smart contract development. In …9.8
• CVE-2021-39168OpenZepplin is a library for smart contract development. In …9.8
• CVE-2021-39169Misskey is a decentralized microblogging platform. In versio…5.4
• CVE-2021-39170Pimcore is an open source data & experience management platf…5.4
• CVE-2021-39171Passport-SAML is a SAML 2.0 authentication provider for Pass…7.5
• CVE-2021-39172Cachet is an open source status page system. Prior to versio…8.8
• CVE-2021-39173Cachet is an open source status page system. Prior to versio…8.8
• CVE-2021-39174Cachet is an open source status page system. Prior to versio…8.8
• CVE-2021-39175HedgeDoc is a platform to write and share markdown. In versi…6.1