Read the docs
TI-2021-19629 Aliases CVE-2021-43823

Side-channel attack in Sourcegraph

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects the Saved Searches and Code Monitoring features. A successful attack would require an authenticated bad actor to create many Saved Searches or Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in version 3.33.2 and any future versions of Sourcegraph. We strongly encourage upgrading to secure versions. If you are unable to, you may disable Saved Searches and Code Monitors.

Why it matters now

EPSS 0.00865 58th percentileScored 2026-11-07
Fix Fixed sourcegraph (sourcegraph): 3.33.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
sourcegraphsourcegraphbefore 3.33.23.33.2Patch availableCNA
  • sourcegraph Vendorsourcegraph Affected before 3.33.2 Fixed in 3.33.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:*before 3.33.2Vulnerablesourcegraph
  • cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:* Versions before 3.33.2 Vulnerable ·sourcegraph

Remediation

  • Fix · CNA sourcegraph (sourcegraph) Fixed in 3.33.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43823

References

Patch 1

Advisory 1

  • TI-2022-07694 Code Injection in Sourcegraph CVSS 3.1HIGH 8.8
  • TI-2022-20284 Incorrect default permissions found in Sourcegraph CVSS 3.1CRITICAL 9.0
  • TI-2022-20283 Sourcegraph vulnerable to Comand Injection via gitserver CVSS 3.1HIGH 7.9
  • TI-2022-11715 Remote Code Execution in sourcegraph CVSS 3.1HIGH 7.2
  • TI-2022-07695 Side-channel attack in Sourcegraph Code Monitors CVSS 3.1MEDIUM 6.5
  • TI-2020-09815 Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper… CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences