CVE-2021-3636

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-30 · updated 2026-06-17
Weakness: CWE-295

Description

It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificates signed by the trusted Service CA. The incorrect inclusion of additional CAs in this certificate would allow an attacker that compromises any of the additional CAs to masquerade as a trusted in-cluster service.

Affected products

Openshift: before 4.8 — fixed in 4.8

How to fix

Upgrade to a fixed version: Openshift 4.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3636 or the next vulnerability affects your stack