CVE-2021-3495

8.8 HIGH

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7

Published: 2021-06-01 · Last updated: 2026-06-17

Severity and scoring

CVSS: 8.8 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-281

Affected products

Vendor	Product
netlify	kiali-operator, openshift_service_mesh
redhat	kiali-operator, openshift_service_mesh

Description

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3495
[Patch]https://bugzilla.redhat.com/show_bug.cgi?id=1947361
[Vendor advisory]https://kiali.io/news/security-bulletins/kiali-security-003/
[Patch]https://bugzilla.redhat.com/show_bug.cgi?id=1947361
[Vendor advisory]https://kiali.io/news/security-bulletins/kiali-security-003/

Related CVEs

Same vendor

CVE-2026-1767 — A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component (5.6 MEDIUM)
CVE-2026-1766 — A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 com... (5.6 MEDIUM)
CVE-2026-11793 — A stack buffer overflow flaw was found in 389 Directory Server (4.9 MEDIUM)
CVE-2026-11790 — A flaw was found in 389 Directory Server (4.9 MEDIUM)
CVE-2026-11789 — A flaw was found in 389 Directory Server (4.9 MEDIUM)

Same CWE

CVE-2026-40767 — Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions (7.5 HIGH)
CVE-2024-47270 — Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 an... (2.7 LOW)
CVE-2026-44832 — Snipe-IT is an IT asset/license management system (8.8 HIGH)
CVE-2026-24194 — NVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler, where a user could cause improper permission han... (7.8 HIGH)
CVE-2026-34744 — Mantis Bug Tracker (MantisBT) is an open source issue tracker