CVE-2021-27099

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-05 · updated 2026-06-17
Weakness: CWE-863

Description

In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID templating feature, which may allow the issuance of an arbitrary SPIFFE ID within the same trust domain, if the attacker controls the value of an EC2 tag prior to attestation, and the attestor is configured for agent ID templating where the tag value is the last element in the path. This issue has been fixed in SPIRE versions 0.11.3 and 0.12.1

Affected products

Cncf Spire: before 0.8.5; from 0.9.0 before 0.9.4; from 0.10.0 before 0.10.2; from 0.11.0 before 0.11.3; from 0.12.0 before 0.12.1 — fixed in 0.10.2, 0.11.3, 0.12.1, 0.8.5, 0.9.4

How to fix

Upgrade to a fixed version: Cncf Spire 0.10.2, 0.11.3, 0.12.1, 0.8.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-27099 or the next vulnerability affects your stack