VULNERABILITY INTELLIGENCE

CVE-2021-36780

CVSS score8.1 HIGH

EPSS probability0.47%

CISA KEVNot currently listed

Published2021-12-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v.

Weakness classification

meissner@suse.de: CWE-306
nvd@nist.gov: CWE-306

Primary references

meissner@suse.de — Issue Tracking, Vendor Advisory
meissner@suse.de — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory