CVE-2024-9858

There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the action to delete the local user “m2cuser”. We recommend upgrading to 1.2.3 or beyond

• CWE-276

• https://cloud.google.com/migrate/containers/docs/m2c-cli-relnotes#october_8_2024Vendor Advisory

Published

Oct 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9850The SVG Case Study plugin for WordPress is vulnerable to Sto…6.4
• CVE-2024-9851The LSX Tour Operator plugin for WordPress is vulnerable to …5.4
• CVE-2024-9852Uncontrolled Search Path Element vulnerability in Mitsubishi…7.8
• CVE-2024-9853The ID-SK Toolkit plugin for WordPress is vulnerable to Stor…6.4
• CVE-2024-9855A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCR…7.2
• CVE-2024-9856A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCR…4.8
• CVE-2024-9859Type confusion in WebAssembly in Google Chrome prior to 126.…8.8
• CVE-2024-9860The Bridge Core plugin for WordPress is vulnerable to unauth…5.4
• CVE-2024-9861The Miniorange OTP Verification with Firebase plugin for Wor…8.1
• CVE-2024-9862The Miniorange OTP Verification with Firebase plugin for Wor…9.8
• CVE-2024-9863The Miniorange OTP Verification with Firebase plugin for Wor…9.8
• CVE-2024-9864The EventPrime – Events Calendar, Bookings and Tickets plugi…6.1