{"id":"CVE-2024-12582","aliases":["EUVD-2024-50973","GHSA-jwxc-5ch3-vxqq"],"status":"published","title":"Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service","description":"A flaw was found in the skupper console,  a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the \"admin\" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00514,"percentile":0.44314,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-305"],"published":"2024-12-24T03:31:24Z","modified":"2026-10-28T02:30:32Z","products":[{"vendor":"red hat","product":"red hat service interconnect 1"},{"vendor":"red hat","product":"service interconnect 1 for rhel 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:1413","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12582","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2333540","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/skupperproject/skupper/pull/1833","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12582","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jwxc-5ch3-vxqq"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/skupperproject/skupper/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12582.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-12582","title":"Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service","description":"A flaw was found in the skupper console,  a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the \"admin\" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.","status":"published","published":"2024-12-24T03:31:24.896Z","modified":"2026-06-18T08:31:49.281Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:34:12.287582Z"}],"euvd":[{"id":"EUVD-2024-50973","description":"A flaw was found in the skupper console,  a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the \"admin\" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.","status":"published","published":"2024-12-24T03:31:24Z","modified":"2026-06-18T08:31:49Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:37.064261Z"}],"ghsa":[{"id":"GHSA-jwxc-5ch3-vxqq","title":"A flaw was found in the skupper console,  a read-only interface that renders cluster network,...","description":"A flaw was found in the skupper console,  a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the \"admin\" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.","status":"published","published":"2024-12-24T06:30:42Z","modified":"2026-05-06T18:30:24Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:07:55.247215Z"}],"nvd":[{"id":"CVE-2024-12582","description":"A flaw was found in the skupper console,  a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the \"admin\" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.","status":"published","published":"2024-12-24T04:15:05.137Z","modified":"2026-06-18T09:16:08.7Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:10:40.507978Z"}],"osv":[{"id":"CVE-2024-12582","title":"Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service","description":"A flaw was found in the skupper console,  a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the \"admin\" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.","status":"published","published":"2024-12-24T03:31:24.896Z","modified":"2026-10-28T02:30:32.285044645Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:44:37.917085Z"}]}}