In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.
Summary
In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:supervisord:supervisor:*:*:*:*:*:*:*:* | up to 4.0.2 | Vulnerable | Supervisord |
- cpe:2.3:a:supervisord:supervisor:*:*:*:*:*:*:*:* Versions up to 4.0.2 Vulnerable ·Supervisord
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12105
- 2026-10-03 Alias added: GHSA-6x94-2xr2-xgw3
References
More Supervisord Supervisor vulnerabilities
- TI-2017-08592 The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4… CVSS 3.0HIGH 8.8
Sources
- CVE-2019-12105 · CVE Program
- CVE-2019-12105 · NVD
- FIRST EPSS
- GHSA-6x94-2xr2-xgw3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences