TI-2022-16534 Aliases CVE-2022-36111 GHSA-672p-m5jq-mrh8

immundb has insufficient verification of data authenticity

MEDIUM 58CWE-345Published 2022-11-23 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a genuine immudb server and requires the client to perform a specific list of verified operations resulting in acceptance of an invalid state value. This vulnerability only affects immudb client SDKs, the immudb server itself is not affected by this vulnerability. This issue has been patched in version 1.4.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00425 37th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed immudb (codenotary): 1.4.1github.com/codenotary/immudb (Go): 1.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
codenotary	immudb	before 1.4.1	1.4.1	Patch available	CNA
—	github.com/codenotary/immudb (Go)	before 1.4.1	1.4.1	Patch available	GHSA-672p-m5jq-mrh8

immudb Vendorcodenotary Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA
github.com/codenotary/immudb (Go) Vendor— Affected before 1.4.1 Fixed in 1.4.1 Patch available GHSA-672p-m5jq-mrh8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:codenotary:immudb::::::::	before 1.4.1	Vulnerable	codenotary

cpe:2.3:a:codenotary:immudb:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·codenotary

Remediation

Fix · CNA immudb (codenotary) Fixed in 1.4.1
Fix · GHSA-672p-m5jq-mrh8 github.com/codenotary/immudb (Go) Fixed in 1.4.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-36111
2026-10-03 Alias added: GHSA-672p-m5jq-mrh8

References

Exploit 2

Advisory 3

Other 4

TI-2024-27562 mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and… CVSS 3.1HIGH 7.4
TI-2022-18579 Lack of proper validation in immudb CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences