CVE-2021-43832 Improper Access Control in spinnaker
Unauthenticated users can create and execute pipelines in Spinnaker if RBAC is not configured, allowing remote code execution and resource deployment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-43832?
CVE-2021-43832 is a critical missing authorization vulnerability in spinnaker, published on 4 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup Role-based access control (RBAC) with-in spinnaker, this enables remote execution and access to deploy almost any resources on any account. Patches are available on the latest releases of the supported branches and users are advised to upgrade as soon as possible. Users unable to upgrade should enable RBAC on ALL accounts and applications. This mitigates the ability of a pipeline to affect any accounts. Block application access unless permission are enabled. Users should make sure ALL application creation is restricted via appropriate wildcards.
Weakness: CWE-306
Which versions are affected by CVE-2021-43832?
It affects 1 product.
Products include Linuxfoundation Spinnaker.
How do I fix CVE-2021-43832?
No fix has been published for CVE-2021-43832 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-43832 being exploited?
There is no known exploitation of CVE-2021-43832 in the wild and no public exploit code.
Other vulnerabilities in spinnaker
- CVE-2026-32604 Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
- CVE-2026-32613 Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
- CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types
- CVE-2020-9301 Code injection in Netflix Spinnaker
- CVE-2025-61916 Spinnaker vulnerable to SSRF due to improper restrictions on http from user input