CVE-2021-41395

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-18 · updated 2026-06-17

Description

Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or username.

Affected products

Goteleport Teleport: from 6.0 before 6.2.12; from 7.0 before 7.1.1 — fixed in 6.2.12, 7.1.1

How to fix

Upgrade to a fixed version: Goteleport Teleport 6.2.12, 7.1.1. Check the vendor advisory for mitigations.

References

https://github.com/gravitational/teleport/releases/tag/v6.2.12
https://github.com/gravitational/teleport/releases/tag/v7.1.1
https://github.com/gravitational/teleport/releases/tag/v6.2.12
https://github.com/gravitational/teleport/releases/tag/v7.1.1

Get alerted when CVE-2021-41395 or the next vulnerability affects your stack