CVE-2021-3586
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do...
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
CVE-2021-3586- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1188
- Updated
- 2026-11-02
CVE List No score
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
CVE-2021-3586- Weakness
- CWE-1188
- Updated
- 2026-11-02
EUVDEUVD-2021-26894 No score
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
EUVD-2021-26894- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hq9j-p426-983m
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do...
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
GHSA-hq9j-p426-983m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1188
- Updated
- 2026-11-02
OSVRHSA-2021:2380
Red Hat Security Advisory: servicemesh-operator security update
- Record
RHSA-2021:2380- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
servicemesh-operatorRed Hat:service_mesh:2.0::el8 |
before 0:2.0.5-3.el8 | 0:2.0.5-3.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3586 is a critical vulnerability (CVSS 9.8) in Redhat Servicemesh-operator, published August 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in servicemesh-operator 0:2.0.5-3.el8.
References
bugzilla.redhat.com/show_bug.cgi?id=1967738
access.redhat.com/security/cve/CVE-2021-3586
nvd.nist.gov/vuln/detail/CVE-2021-3586
github.com/advisories/GHSA-hq9j-p426-983m
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2380.json
cve.org/CVERecord?id=CVE-2021-3586