What’s Vulnerable › Vulnerabilities

CVE-2021-36780: Unauthorized data access from replicas through vulnerable instance manager pods

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-17 · updated 2026-06-17
• Weakness: CWE-306

Description

A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v.

Affected products

• SUSE Longhorn: before 1.1.3; from 1.2.0 before 1.2.3 — fixed in 1.1.3, 1.2.3

How to fix

Upgrade to a fixed version: SUSE Longhorn 1.1.3, 1.2.3. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=1191819
• https://github.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhx
• https://bugzilla.suse.com/show_bug.cgi?id=1191819
• https://github.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhx

Get alerted when CVE-2021-36780 or the next vulnerability affects your stack