Every CVE Search/ Get API key

CVE-2021-3698

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate...

7.5 HighFix available

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.70%Down 0.2 points since Mar 9, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-3698
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-295
Updated
2026-11-02
CVE List No score

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-3698
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2021-26983 No score

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Record
EUVD-2021-26983
Updated
2026-11-03
GitHub AdvisoriesGHSA-w9ph-5m4x-c49r 7.5

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate...

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Record
GHSA-w9ph-5m4x-c49r
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV 7.5

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-3698
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3698 7.5

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Record
DEBIAN-CVE-2021-3698
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2022:2008 7.5

Red Hat Security Advisory: cockpit security, bug fix, and enhancement update

Record
RHSA-2022:2008
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2022:2008 7.5

Moderate: cockpit security, bug fix, and enhancement update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

The following packages have been upgraded to a later upstream version: cockpit (264.1). (BZ#1984902, BZ#1992620, BZ#2004041, BZ#2008208)

Security Fix(es):

  • cockpit: authenticates with revoked certificates (CVE-2021-3698)

  • cockpit: pages vulnerable to clickjacking (CVE-2021-3660)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record
RLSA-2022:2008
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3698 7.5

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Record
UBUNTU-CVE-2021-3698
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2022:2008 No score

Moderate: cockpit security, bug fix, and enhancement update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

The following packages have been upgraded to a later upstream version: cockpit (264.1). (BZ#1984902, BZ#1992620, BZ#2004041, BZ#2008208)

Security Fix(es):

  • cockpit: authenticates with revoked certificates (CVE-2021-3698)

  • cockpit: pages vulnerable to clickjacking (CVE-2021-3660)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:2008
Updated
2026-11-02
OSVMGASA-2022-0202 No score

Updated cockpit packages fix security vulnerability

authenticates with revoked certificates (CVE-2021-3698)

Record
MGASA-2022-0202
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cockpit
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit-bridge
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit-doc
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit-system
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit-ws
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit
Debian:12
 before 260-1
260-1
cockpit
Debian:13
 before 260-1
260-1
cockpit
Debian:14
 before 260-1
260-1
cockpit
Mageia:8
 before 269-1.mga8
269-1.mga8
cockpit
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
Show 8 moreShow less
Affected packages
PackageAffectedFixed
cockpit-bridge
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-doc
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-system
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-ws
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit
Rocky Linux:8
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit
Ubuntu:20.04:LTS
 All versions, plus listed versions
202.1-1204-1206-1207-1208-1
Show 6 moreShow less
210-1211-1212-1213-1214.1-1215-1
 None known

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3698 is a high vulnerability (CVSS 7.5) in Cockpit-hq Cockpit, published March 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in cockpit 264.1-1.el8.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open