GHSA-j3rq-4xjw-xg63
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
GHSA-j3rq-4xjw-xg63 is a vulnerability with no CVSS score yet in github.com/edgelesssys/marblerun, published December 4, 2023. No source lists public exploit code. Fixed in github.com/edgelesssys/marblerun 1.4.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.4.0github.com/edgelesssys/marblerun
Description
Impact
Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.
Patches
The issue has been patched in v1.4.0
Workarounds
Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/edgelesssys/marblerunGo | before 1.4.0 | 1.4.0 |
What each source reports
GitHub AdvisoriesNo score
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
Impact
Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.
Patches
The issue has been patched in v1.4.0
Workarounds
Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.
- Record
GHSA-j3rq-4xjw-xg63- Weakness
- CWE-300
- Updated
- 2026-11-02
OSVNo score
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
Impact
Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.
Patches
The issue has been patched in v1.4.0
Workarounds
Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.
- Record
GHSA-j3rq-4xjw-xg63- Weakness
- CWE-300
- Updated
- 2026-11-02
OSVGO-2023-2378No score
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
- Record
GO-2023-2378- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.