Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki
Priority LOW 34CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root ( https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service ) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00144 3rd percentileScored 2026-11-07
Fix Fixed octorpki (Cloudflare): v1.4.2github.com/cloudflare/cfrpki (Go): 1.4.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | octorpki | before v1.4.2 | v1.4.2 | Patch available | CNA |
| — | github.com/cloudflare/cfrpki (Go) | before 1.4.2 | 1.4.2 | Patch available | GHSA-3pqh-p72c-fj85 |
- octorpki VendorCloudflare Affected before v1.4.2 Fixed in v1.4.2 Patch available CNA
- github.com/cloudflare/cfrpki (Go) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-3pqh-p72c-fj85
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:* | before 1.4.2 | Vulnerable | Cloudflare |
- cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:* Versions before 1.4.2 Vulnerable ·Cloudflare
Remediation
- Fix · CNA octorpki (Cloudflare) Fixed in v1.4.2
- Fix · GHSA-3pqh-p72c-fj85 github.com/cloudflare/cfrpki (Go) Fixed in 1.4.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3978
- 2026-10-03 Alias added: GHSA-3pqh-p72c-fj85
References
More Cloudflare Octorpki vulnerabilities
- TI-2021-02817 Arbitrary filepath traversal via URI injection CVSS 3.1CRITICAL 9.8
- TI-2021-02819 Infinite open connection causes OctoRPKI to hang forever CVSS 3.1HIGH 7.5
- TI-2021-02820 NUL character in ROA causes OctoRPKI to crash CVSS 3.1HIGH 7.5
- TI-2021-02693 OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values CVSS 3.1HIGH 7.5
- TI-2021-02818 Infinite certificate chain depth results in OctoRPKI running forever CVSS 3.1HIGH 7.5
- TI-2022-03327 OctoRPKI crash when maximum iterations number is reached CVSS 3.1HIGH 7.5
Sources
- CVE-2021-3978 · CVE Program
- CVE-2021-3978 · NVD
- FIRST EPSS
- GHSA-3pqh-p72c-fj85 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences