CVE-2023-47631

vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. This impacts all servers that are breached by an expert user. This vulnerability has been patched in version 4.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-345

• https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268Product
• https://github.com/vantage6/vantage6/commit/bf83521eb12fa80aa5fc92ef1692010a9a7f8243Patch
• https://github.com/vantage6/vantage6/security/advisories/GHSA-vc3v-ppc7-v486Vendor Advisory
• https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268Product
• https://github.com/vantage6/vantage6/commit/bf83521eb12fa80aa5fc92ef1692010a9a7f8243Patch
• https://github.com/vantage6/vantage6/security/advisories/GHSA-vc3v-ppc7-v486Vendor Advisory

Published

Nov 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47626iTop is an IT service management platform. When displaying/…6.1
• CVE-2023-47627aiohttp is an asynchronous HTTP client/server framework for …7.5
• CVE-2023-47628DataHub is an open-source metadata platform. DataHub Fronten…4.8
• CVE-2023-47629DataHub is an open-source metadata platform. In affected ver…8
• CVE-2023-4763Use after free in Networks in Google Chrome prior to 116.0.5…8.8
• CVE-2023-47630Kyverno is a policy engine designed for Kubernetes. An issue…7.1
• CVE-2023-47633Traefik is an open source HTTP reverse proxy and load balanc…7.5
• CVE-2023-47634Decidim is a participatory democracy framework. Starting in …3.1
• CVE-2023-47635Decidim is a participatory democracy framework. Starting in …5.7
• CVE-2023-47636The Pimcore Admin Classic Bundle provides a Backend UI for P…5.3
• CVE-2023-47637Pimcore is an Open Source Data & Experience Management Platf…8.8
• CVE-2023-47638Rejected reason: Confirm reference is not public.