CVE-2024-41265

cortex establishes TLS connections with `InsecureSkipVerify` set to `true`

7.5 HighFix available

CVE-2024-41265 is a high vulnerability (CVSS 7.5) in Linuxfoundation Cortex, published August 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in govulncheck-vulndb 0.0.20251230T014957-150000.1.134.1.

A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.26%Up 0.2 points since Aug 6, 2024

What each source reports

CVE List Score used 7.5

A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.

Record: CVE-2024-41265
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-599
Updated: 2026-11-02

EUVDEUVD-2024-2668 7.5

A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.

Record: EUVD-2024-2668
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vw7g-3cc7-7rmh 8.7

cortex establishes TLS connections with `InsecureSkipVerify` set to `true`

A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.

Record: GHSA-vw7g-3cc7-7rmh
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-599
Updated: 2026-11-02

NVD 7.5

A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.

Record: CVE-2024-41265
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-599
Updated: 2026-11-02

OSVGHSA-vw7g-3cc7-7rmh 8.7

cortex establishes TLS connections with `InsecureSkipVerify` set to `true`

A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.

Record: GHSA-vw7g-3cc7-7rmh
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-599
Updated: 2026-11-02

OSVGO-2024-3036 No score

cortex establishes TLS connections with `InsecureSkipVerify` set to `true` in github.com/cortexproject/cortex

cortex establishes TLS connections with InsecureSkipVerify set to true in github.com/cortexproject/cortex

Record: GO-2024-3036
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
GO-2026-5933 GHSA-3g4q-2f67-2gvh
GO-2026-5934 GHSA-59qp-cfj3-rp64
GO-2026-5935 GHSA-7856-g3gv-9wq8
GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
GO-2026-5942 CVE-2026-46600
GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
GO-2026-5969 GHSA-g936-7jqj-mwv8
GO-2026-5970 CVE-2026-56852
GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
GO-2026-5981 GHSA-mqxv-9rm6-w8qc
GO-2026-5982 GHSA-pqg7-v6wh-3pfp
GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
GO-2026-5985 GHSA-7rx3-5wx3-5v76
GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

Record: openSUSE-SU-2026:21483-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0037-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20251230T014957 2025-12-30T01:49:57Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-4249 CVE-2025-68120 CVE-2025-68120
- GO-2025-4254 CVE-2025-62190 GHSA-gmx5-frv9-9m9f
- GO-2025-4255 CVE-2025-12689 GHSA-j5vq-62gr-8v3r
- GO-2025-4256 CVE-2025-13324 GHSA-x3r8-2hmh-89f5
- GO-2025-4257 CVE-2025-68476 GHSA-c4p6-qg4m-9jmr
- GO-2025-4258 CVE-2025-68938 GHSA-cm54-pfmc-xrwx
- GO-2025-4261 CVE-2025-68939 GHSA-263q-5cv3-xq9g
- GO-2025-4262 CVE-2025-68945 GHSA-7xq4-mwcp-q8fx
- GO-2025-4263 CVE-2025-68942 GHSA-898p-hh3p-hf9r
- GO-2025-4264 CVE-2025-68944 GHSA-f85h-c7m6-cfpm
- GO-2025-4265 CVE-2025-68946 GHSA-hq57-c72x-4774
- GO-2025-4266 CVE-2025-68943 GHSA-jhx5-4vr4-f327
- GO-2025-4267 CVE-2025-68940 GHSA-rrcw-5rjv-vj26
- GO-2025-4268 CVE-2025-68941 GHSA-xfq3-qj7j-4565
Update to version 0.0.20251222T181535 2025-12-22T18:15:35Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-4241 CVE-2025-11393 GHSA-cc8c-28gj-px38
- GO-2025-4242 CVE-2025-13888 GHSA-pcqx-8qww-7f4v
- GO-2025-4243 GHSA-wh6m-h6f4-rjf4
- GO-2025-4244 CVE-2025-68274 GHSA-c623-f998-8hhv
- GO-2025-4245 CVE-2025-68156 GHSA-cfpf-hrx2-8rv6
- GO-2025-4247 CVE-2025-13352 GHSA-jf5h-xfw4-p8gp
- GO-2025-4250 CVE-2025-14764 GHSA-3g75-q268-r9r6
Update to version 0.0.20251216T193914 2025-12-16T19:39:14Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-4239 CVE-2025-68113 GHSA-6gvq-jcmp-8959
- GO-2025-4240 CVE-2025-13281 GHSA-r6j8-c6r2-37rr
Update to version 0.0.20251216T162327 2025-12-16T16:23:27Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2024-3036 CVE-2024-41265 GHSA-vw7g-3cc7-7rmh
- GO-2024-3057 CVE-2024-41260 GHSA-9v35-4xcr-w9ph
- GO-2025-3437 GHSA-274v-mgcv-cm8j
- GO-2025-3465 CVE-2025-0426 GHSA-jgfp-53c3-624w
- GO-2025-3764 CVE-2024-44905 GHSA-6xp3-p59p-q4fj
- GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp
- GO-2025-4116 CVE-2025-47913
- GO-2025-4122 CVE-2025-11777 GHSA-mqcj-8c2g-h97q
- GO-2025-4178 CVE-2025-13870 GHSA-58w6-w55x-6wq8
Update to version 0.0.20251215T203741 2025-12-15T20:37:41Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-4136 CVE-2025-64708 GHSA-ch7q-53v8-73pc
- GO-2025-4137 CVE-2025-64521 GHSA-xr73-jq5p-ch8r
- GO-2025-4148 CVE-2017-18874 GHSA-8qg8-c7mw-6fj7
- GO-2025-4154 CVE-2025-62155 GHSA-9f46-w24h-69w4
- GO-2025-4161 CVE-2025-65942 GHSA-66jq-2c23-2xh5
- GO-2025-4162 CVE-2025-60633 GHSA-3j9f-7w24-pcqg
- GO-2025-4167 CVE-2025-64715 GHSA-38pp-6gcp-rqvm
- GO-2025-4168 CVE-2025-12419 GHSA-3x39-62h4-f8j6
- GO-2025-4169 CVE-2025-12559 GHSA-4g87-9x45-cx2h
- GO-2025-4170 CVE-2025-12421 GHSA-mp6x-97xj-9x62
- GO-2025-4173 CVE-2025-10543 GHSA-32fw-gq77-f2f2
- GO-2025-4188 CVE-2025-65637 GHSA-4f99-4q7p-p3gh
- GO-2025-4191 CVE-2017-18878 GHSA-h564-6gc2-fcc6
- GO-2025-4199 CVE-2017-18887 GHSA-35c4-5qfp-wxj6
- GO-2025-4200 CVE-2017-18885 GHSA-g78f-6xq7-rrhq
- GO-2025-4201 CVE-2017-18889 GHSA-jp57-4x34-5v94
- GO-2025-4202 CVE-2017-18890 GHSA-m497-hq5x-6jcv
- GO-2025-4203 CVE-2017-18888 GHSA-v2vm-hq26-5jv6
- GO-2025-4204 CVE-2017-18886 GHSA-wvjg-33p9-938h
- GO-2025-4205 CVE-2025-66491 GHSA-7vww-mvcr-x6vj
- GO-2025-4206 CVE-2025-66490 GHSA-gm3x-23wp-hc2c
- GO-2025-4207 CVE-2025-66508 GHSA-7cqv-qcq2-r765
- GO-2025-4208 CVE-2025-66565 GHSA-m98w-cqp3-qcqr
- GO-2025-4209 CVE-2025-66507 GHSA-qmg5-v42x-qqhq
- GO-2025-4210 CVE-2025-67494 GHSA-7wfc-4796-gmg5
- GO-2025-4211 GHSA-m6wq-66p2-c8pc
- GO-2025-4212 GHSA-pfrf-9r5f-73f5
- GO-2025-4213 CVE-2025-67495 GHSA-v959-qxv6-6f8p
- GO-2025-4214 GHSA-4rmq-mc2c-r495
- GO-2025-4215 CVE-2025-65796 GHSA-8jcj-g9f4-qx42
- GO-2025-4216 CVE-2025-65798 GHSA-8p44-g572-557h
- GO-2025-4217 CVE-2025-65795…

Record: SUSE-SU-2026:0037-1
Updated: 2026-11-02

Affected products

linuxfoundation cortex

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/cortexproject/cortex` Go	through 0.42.1	None known
`github.com/cortexlabs/cortex` Go	All versions	None known
`govulncheck-vulndb` openSUSE:Leap 15.6	before 0.0.20251230T014957-150000.1.134.1	0.0.20251230T014957-150000.1.134.1
`govulncheck-vulndb` openSUSE:Leap 16.0	before 0.0.20260723T184607-160000.1.1	0.0.20260723T184607-160000.1.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 1,540 references and the rest of 2 source descriptions. The JSON record has them.