VULNERABILITY INTELLIGENCE

CVE-2021-3528

CVSS score8.8 HIGH

EPSS probability0.89%

CISA KEVNot currently listed

Published2021-05-13

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration.

Weakness classification

secalert@redhat.com: CWE-522
nvd@nist.gov: CWE-532

Primary references

secalert@redhat.com — Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory