Read the docs
TI-2016-09156 Aliases CVE-2016-15036GHSA-jpfp-xq3p-4h3r

Deis Workflow Manager race condition

Priority LOW 33CWE-362Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Deis Workflow Manager up to 2.3.2. It has been classified as problematic. This affects an unknown part. The manipulation leads to race condition. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.3.3 is able to address this issue. The patch is named 31fe3bccbdde134a185752e53380330d16053f7f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248847. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

EPSS 0.00399 34th percentileScored 2026-11-07
Fix Fixed github.com/deis/workflow-manager (Go): 2.3.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DeisWorkflow Manager2.3.0; 2.3.1; 2.3.2—No fix listedCNA
—github.com/deis/workflow-manager (Go)before 2.3.32.3.3Patch availableGHSA-jpfp-xq3p-4h3r
  • Workflow Manager VendorDeis Affected 2.3.0; 2.3.1; 2.3.2 Fixed in — No fix listed CNA
  • github.com/deis/workflow-manager (Go) Vendor— Affected before 2.3.3 Fixed in 2.3.3 Patch available GHSA-jpfp-xq3p-4h3r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:deis:workflow_manager:*:*:*:*:*:go:*:*up to 2.3.2VulnerableDeis
  • cpe:2.3:a:deis:workflow_manager:*:*:*:*:*:go:*:* Versions up to 2.3.2 Vulnerable ·Deis

Remediation

  • Fix · GHSA-jpfp-xq3p-4h3r github.com/deis/workflow-manager (Go) Fixed in 2.3.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-15036
  2. 2026-10-03 Alias added: GHSA-jpfp-xq3p-4h3r

References

Patch 3

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences