CVE-2021-20278 Kiali Authentication Bypass vulnerability
Attackers can bypass authentication in Kiali when using OpenID implicit flow with RBAC disabled, allowing unauthorized access to the service mesh console.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-20278?
CVE-2021-20278 is a medium-severity authentication bypass vulnerability in kiali, published on 28 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
Which versions are affected by CVE-2021-20278?
3 open source packages ship an affected version, including github.com/kiali/kiali. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kiali/kiali Go | All versions | 1.31.0 |
github.com/kiali/kiali Go | All versions | 1.31.0 |
github.com/kiali/kiali Go | All versions | 1.31.0 |
Products include Kiali Kiali.
How do I fix CVE-2021-20278?
Upgrade github.com/kiali/kiali to 1.31.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-20278 being exploited?
There is no known exploitation of CVE-2021-20278 in the wild and no public exploit code.
Other vulnerabilities in kiali
Sources
Also known as GHSA-ggjr-2f7v-vhq4, GO-2022-0700.