CVE-2021-3020

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-26 · updated 2026-06-17
Weakness: CWE-269

Description

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.

Affected products

ClusterLabs Hawk: through 2.3.0-15

References

https://bugzilla.suse.com/show_bug.cgi?id=1180571
https://github.com/ClusterLabs/crmsh/commit/c538024b8ebd138dc373b005189471d9b77e9c82
https://github.com/ClusterLabs/hawk/releases
https://bugzilla.suse.com/show_bug.cgi?id=1180571
https://github.com/ClusterLabs/crmsh/commit/c538024b8ebd138dc373b005189471d9b77e9c82
https://github.com/ClusterLabs/hawk/releases

Get alerted when CVE-2021-3020 or the next vulnerability affects your stack