CVE-2021-41087

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.

• CWE-345
• CWE-22

• https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290Patch, Third Party Advisory
• https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3Third Party Advisory
• https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290Patch, Third Party Advisory
• https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3Third Party Advisory

Published

Sep 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41080Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41081Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41082Discourse is a platform for community discussion. In affecte…7.5
• CVE-2021-41083Dada Mail is a web-based e-mail list management system. In a…8.8
• CVE-2021-41084http4s is an open source scala interface for HTTP. In affect…4.7
• CVE-2021-41086jsuites is an open source collection of common required java…5.4
• CVE-2021-41088Elvish is a programming language and interactive shell, comb…8.8
• CVE-2021-41089Moby is an open-source project created by Docker to enable s…6.3
• CVE-2021-41090Grafana Agent is a telemetry collector for sending metrics, …7.5
• CVE-2021-41091Moby is an open-source project created by Docker to enable s…6.3
• CVE-2021-41092Docker CLI is the command line interface for the docker cont…7.5
• CVE-2021-41093Wire is an open source secure messenger. In affected version…9.8