CVE-2021-43832

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup Role-based access control (RBAC) with-in spinnaker, this enables remote execution and access to deploy almost any resources on any account. Patches are available on the latest releases of the supported branches and users are advised to upgrade as soon as possible. Users unable to upgrade should enable RBAC on ALL accounts and applications. This mitigates the ability of a pipeline to affect any accounts. Block application access unless permission are enabled. Users should make sure ALL application creation is restricted via appropriate wildcards.

• CWE-306
• CWE-306

• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-9h7c-rfrp-gvgpThird Party Advisory
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-9h7c-rfrp-gvgpThird Party Advisory

Published

Jan 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43827discourse-footnote is a library providing footnotes for post…4.3
• CVE-2021-43828PatrOwl is a free and open-source solution for orchestrating…7.5
• CVE-2021-43829PatrOwl is a free and open-source solution for orchestrating…8.8
• CVE-2021-4383The WP Quick FrontEnd Editor plugin for WordPress is vulnera…4.3
• CVE-2021-43830OpenProject is a web-based project management software. Open…8.8
• CVE-2021-43831Gradio is an open source framework for building interactive …7.7
• CVE-2021-43833eLabFTW is an electronic lab notebook manager for research t…8.8
• CVE-2021-43834eLabFTW is an electronic lab notebook manager for research t…9.8
• CVE-2021-43835Sulu is an open-source PHP content management system based o…7.2
• CVE-2021-43836Sulu is an open-source PHP content management system based o…8.8
• CVE-2021-43837vault-cli is a configurable command-line interface tool (and…9.1
• CVE-2021-43838jsx-slack is a library for building JSON objects for Slack B…7.5