Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2022-0270: Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
CVE-2022-0270 · published 4 years ago
Summary
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
What to do
- Update mirantis bored-agent to version 0.6.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mirantis | bored-agent |
< 0.6.1 cpe:2.3:a:mirantis:bored-agent:*:*:*:*:*:*:*:* |
Original advisory text
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
References
- https://github.com/Mirantis/security/blob/main/advisories/0004.md Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-284Improper Access Control
Timeline
Published25 Jan 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-0270 · NVD
Track software like this
Free during beta