{"id":"CVE-2022-36633","aliases":["EUVD-2022-6495","GHSA-6xf3-5hp7-xqqg"],"status":"published","title":"Improper token validation leading to code execution in Teleport","description":"Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.50275,"percentile":0.98916,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-77","CWE-78"],"published":"2022-08-24T12:29:54Z","modified":"2026-10-28T02:30:31Z","exploits":[{"source":"exploitdb","id":"EDB-51019","title":"Teleport v10.1.1 - Remote Code Execution (RCE)","type":"remote","platform":"multiple","date":"2022-09-23","url":"https://www.exploit-db.com/exploits/51019"}],"fixes":[{"ecosystem":"Go","package":"github.com/gravitational/teleport","fixed_in":["8.3.17","9.3.13","10.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/gravitational/teleport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.17"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/gravitational/teleport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.3.13"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/gravitational/teleport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.1.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gravitational/teleport","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.3.17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gravitational/teleport","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.3.13"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gravitational/teleport","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.1.2"}]}]}],"products":[{"vendor":"goteleport","product":"teleport"}],"references":[{"url":"https://github.com/gravitational/teleport","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","package"]},{"url":"https://packetstormsecurity.com/files/168137/Teleport-9.3.6-Command-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"http://packetstormsecurity.com/files/168477/Teleport-10.1.1-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36633","tags":["advisory"]},{"url":"https://github.com/gravitational/teleport/pull/14726","tags":["web"]},{"url":"https://github.com/gravitational/teleport/pull/14726/commits/46c23b9b64b944d1e82d2c8a79083f291ffdd3b6","tags":["web"]},{"url":"https://github.com/gravitational/teleport/releases/tag/v10.1.2","tags":["web"]},{"url":"https://github.com/gravitational/teleport/releases/tag/v8.3.17","tags":["web"]},{"url":"https://github.com/gravitational/teleport/releases/tag/v9.3.13","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6xf3-5hp7-xqqg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36633.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-36633","description":"Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.","status":"published","published":"2022-08-24T12:29:54Z","modified":"2024-08-03T10:07:34.522Z","updated_at":"2026-11-02T14:34:35.615708Z"}],"euvd":[{"id":"EUVD-2022-6495","description":"Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.","status":"published","published":"2022-08-24T12:29:54Z","modified":"2024-08-03T10:07:34Z","updated_at":"2026-11-03T03:25:25.152226Z"}],"ghsa":[{"id":"GHSA-6xf3-5hp7-xqqg","title":"Improper token validation leading to code execution in Teleport","description":"Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.","status":"published","published":"2022-08-25T00:00:28Z","modified":"2023-08-08T21:13:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-77"],"updated_at":"2026-11-02T14:36:59.456342Z"}],"nvd":[{"id":"CVE-2022-36633","description":"Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.","status":"published","published":"2022-08-24T13:15:08.13Z","modified":"2026-06-17T04:53:46.75Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:25.883929Z"}],"osv":[{"id":"GHSA-6xf3-5hp7-xqqg","title":"Improper token validation leading to code execution in Teleport","description":"Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.","status":"published","published":"2022-08-25T00:00:28Z","modified":"2026-08-07T08:12:02.121526161Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-77"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"CVE-2022-36633","description":"Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.","status":"published","published":"2022-08-24T12:29:54Z","modified":"2026-10-28T02:30:31.462497387Z","updated_at":"2026-11-02T15:44:26.53798Z"}]}}