CVE-2022-21707

wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers. In versions prior to 0.52.2 actors can bypass capability authorization. Actors are normally required to declare their capabilities for inbound invocations, but with this vulnerability actor capability claims are not verified upon receiving invocations. This compromises the security model for actors as they can receive unauthorized invocations from linked capability providers. The problem has been patched in versions `0.52.2` and greater. There is no workaround and users are advised to upgrade to an unaffected version as soon as possible.

• CWE-863
• CWE-862

• https://github.com/wasmCloud/wasmcloud-otp/commit/fd07262074b98b06106a31fd1957dc2319d438a5Patch, Third Party Advisory
• https://github.com/wasmCloud/wasmcloud-otp/security/advisories/GHSA-2cmx-rr54-88g5Third Party Advisory
• https://github.com/wasmCloud/wasmcloud-otp/commit/fd07262074b98b06106a31fd1957dc2319d438a5Patch, Third Party Advisory
• https://github.com/wasmCloud/wasmcloud-otp/security/advisories/GHSA-2cmx-rr54-88g5Third Party Advisory

Published

Jan 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21701Istio is an open platform to connect, manage, and secure mic…8.8
• CVE-2022-21702Grafana is an open-source platform for monitoring and observ…5.4
• CVE-2022-21703Grafana is an open-source platform for monitoring and observ…8.8
• CVE-2022-21704log4js-node is a port of log4js to node.js. In affected vers…5.5
• CVE-2022-21705Octobercms is a self-hosted CMS platform based on the Larave…7.2
• CVE-2022-21706Zulip is an open-source team collaboration tool with topic-b…9.8
• CVE-2022-21708graphql-go is a GraphQL server with a focus on ease of use. …6.5
• CVE-2022-2171The Progressive License WordPress plugin through 1.1.0 is la…5.4
• CVE-2022-21710ShortDescription is a MediaWiki extension that provides loca…6.1
• CVE-2022-21711elfspirit is an ELF static analysis and injection framework …7.1
• CVE-2022-21712twisted is an event-driven networking engine written in Pyth…7.5
• CVE-2022-21713Grafana is an open-source platform for monitoring and observ…4.3