Read the docs
TI-2020-06500 Aliases CVE-2020-8030GHSA-h8q4-9ggw-gcm9

skuba: Insecure /tmp usage when joining node to cluster

Priority LOW 20CWE-377Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file before it is processed, leading to arbitrary modifications of the machine/cluster.

Why it matters now

EPSS 0.00253 16th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed SUSE CaaS Platform 4.5 (SUSE): 2.1.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE CaaS Platform 4.5suba to before 2.1.72.1.7Patch availableCNA
  • SUSE CaaS Platform 4.5 VendorSUSE Affected suba to before 2.1.7 Fixed in 2.1.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:caas_platform:4.5:*:*:*:*:*:*:*4.5VulnerableSUSE
  • cpe:2.3:a:suse:caas_platform:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·SUSE

Remediation

  • Fix · CNA SUSE CaaS Platform 4.5 (SUSE) Fixed in 2.1.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8030
  2. 2026-10-03 Alias added: GHSA-h8q4-9ggw-gcm9

References

Exploit 1

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2017-13226 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before… CVSS 3.1CRITICAL 9.8
  • TI-2019-02704 Insecure API port exposed to all Master Node guest containers CVSS 3.1HIGH 8.4
  • TI-2022-10358 In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip=… CVSS 3.1HIGH 7.8
  • TI-2020-06499 skuba: Insecure handling of private key CVSS 3.1MEDIUM 4.0
  • TI-2018-04832 The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files CVSS 3.0LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences