CVE-2024-40632

Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/shutdown. Linkerd could introduce an optional environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that do not include this header. This issue has been addressed in release version edge-24.6.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-918

• https://github.com/linkerd/linkerd2-proxy/blob/46957de49f25fd4661af7b7c52659148f4d6dd27/linkerd/app/admin/src/server.rs
• https://github.com/linkerd/linkerd2/commit/35fb2d6d11ef6520ae516dd717790529f85224fa
• https://github.com/linkerd/linkerd2/security/advisories/GHSA-6v94-gj6x-jqj7
• https://github.com/linkerd/linkerd2-proxy/blob/46957de49f25fd4661af7b7c52659148f4d6dd27/linkerd/app/admin/src/server.rs
• https://github.com/linkerd/linkerd2/commit/35fb2d6d11ef6520ae516dd717790529f85224fa
• https://github.com/linkerd/linkerd2/security/advisories/GHSA-6v94-gj6x-jqj7

Published

Jul 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-40627Fastapi OPA is an opensource fastapi middleware which includ…5.8
• CVE-2024-40628JumpServer is an open-source Privileged Access Management (P…9.1
• CVE-2024-40629JumpServer is an open-source Privileged Access Management (P…9.8
• CVE-2024-4063A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build…3.7
• CVE-2024-40630OpenImageIO is a toolset for reading, writing, and manipulat…4.3
• CVE-2024-40631Plate media is an open source, rich-text editor for React. E…8.1
• CVE-2024-40633Sylius is an Open Source eCommerce Framework on Symfony. A s…5.3
• CVE-2024-40634Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2024-40635containerd is an open-source container runtime. A bug was fo…7.8
• CVE-2024-40636Steeltoe is an open source project that provides a collectio…5.3
• CVE-2024-40637dbt enables data analysts and engineers to transform their d…7.8
• CVE-2024-40638GLPI is a free asset and IT management software package. An …8.8