TI-2021-08667 Aliases CVE-2021-27098 GHSA-h746-rm5q-8mgq

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1…

LOW 36CWE-295Published 2021-03-05 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Spoofing, Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295 and CWE-284.

Summary

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1.

Why it matters now

EPSS 0.00558 46th percentileScored 2026-11-07

Fix Fixed github.com/spiffe/spire (Go): 0.8.5, 0.9.4, 0.10.2 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	github.com/spiffe/spire (Go)	0.8.1 to before 0.8.5	0.8.5	Patch available	GHSA-h746-rm5q-8mgq
—	github.com/spiffe/spire (Go)	0.9.0 to before 0.9.4	0.9.4	Patch available	GHSA-h746-rm5q-8mgq
—	github.com/spiffe/spire (Go)	0.10.0 to before 0.10.2	0.10.2	Patch available	GHSA-h746-rm5q-8mgq
—	github.com/spiffe/spire (Go)	0.11.0 to before 0.11.3	0.11.3	Patch available	GHSA-h746-rm5q-8mgq
—	github.com/spiffe/spire (Go)	0.12.0 to before 0.12.1	0.12.1	Patch available	GHSA-h746-rm5q-8mgq

— Vendor— Affected all versions Fixed in — No fix listed CNA
github.com/spiffe/spire (Go) Vendor— Affected 0.8.1 to before 0.8.5 Fixed in 0.8.5 Patch available GHSA-h746-rm5q-8mgq
github.com/spiffe/spire (Go) Vendor— Affected 0.9.0 to before 0.9.4 Fixed in 0.9.4 Patch available GHSA-h746-rm5q-8mgq
github.com/spiffe/spire (Go) Vendor— Affected 0.10.0 to before 0.10.2 Fixed in 0.10.2 Patch available GHSA-h746-rm5q-8mgq
github.com/spiffe/spire (Go) Vendor— Affected 0.11.0 to before 0.11.3 Fixed in 0.11.3 Patch available GHSA-h746-rm5q-8mgq
github.com/spiffe/spire (Go) Vendor— Affected 0.12.0 to before 0.12.1 Fixed in 0.12.1 Patch available GHSA-h746-rm5q-8mgq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cncf:spire::::::::	0.8.1 – 0.8.4; 0.9.0 to before 0.9.4; 0.10.0 to before 0.10.2; 0.11.0 to before 0.11.3; 0.12.0 to before 0.12.1	Vulnerable	Cncf

cpe:2.3:a:cncf:spire:*:*:*:*:*:*:*:* Versions 0.8.1 – 0.8.4; 0.9.0 to before 0.9.4; 0.10.0 to before 0.10.2; 0.11.0 to before 0.11.3; 0.12.0 to before 0.12.1 Vulnerable ·Cncf

Remediation

Fix · GHSA-h746-rm5q-8mgq github.com/spiffe/spire (Go) Fixed in 0.8.5 Advisory →
Fix · GHSA-h746-rm5q-8mgq github.com/spiffe/spire (Go) Fixed in 0.9.4 Advisory →
Fix · GHSA-h746-rm5q-8mgq github.com/spiffe/spire (Go) Fixed in 0.10.2 Advisory →
Fix · GHSA-h746-rm5q-8mgq github.com/spiffe/spire (Go) Fixed in 0.11.3 Advisory →
Fix · GHSA-h746-rm5q-8mgq github.com/spiffe/spire (Go) Fixed in 0.12.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-27098
2026-10-03 Alias added: GHSA-h746-rm5q-8mgq

References

Advisory 2

Other 2

TI-2021-08668 In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node… CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences