Security readout for executives and security teams
Plain-English summary
CVE-2021-3495 is an access-control flaw in kiali-operator before 1.33.0 and before 1.24.7. A cluster user with basic access to deploy a Kiali operand could make the operator deploy a chosen image elsewhere in the cluster, potentially exposing privileged service account tokens.
Executive priority
Treat this as high priority where Kiali is deployed in shared clusters. The issue can turn limited internal cluster access into broader control paths, with possible data, integrity, and availability impact.
Technical view
The flaw is classified as CWE-281, improper preservation of permissions. The operator did not correctly constrain what a low-privileged cluster user could cause it to deploy. Sources describe possible confidentiality, integrity, and availability impact if privileged service account tokens become reachable.
Likely exposure
Exposure is mainly Kubernetes or OpenShift clusters using affected kiali-operator versions where non-admin users can deploy Kiali operands. Internet exposure is not the primary signal; internal cluster RBAC and operator deployment scope matter most.
Exploitation context
The source bundle does not show KEV listing or cited evidence of active exploitation. Exploitation requires an attacker who already has basic cluster access sufficient to deploy a Kiali operand.
Researcher notes
The evidence is concise and does not include CVSS details in the provided bundle. Focus assessment on affected operator versions, RBAC boundaries around Kiali operands, and whether privileged service account tokens could be reached through operator-created workloads.
Mitigation direction
- Upgrade kiali-operator to a non-affected release for the relevant stream.
- Use 1.33.0 or 1.24.7 where those are the vendor-provided fixed versions.
- Review Kiali and Red Hat guidance before applying production changes.
- Restrict who can create Kiali operands and related custom resources.
- Audit service account token exposure and operator permissions.
Validation and detection
- Inventory kiali-operator versions across all clusters.
- Check whether installed versions are before 1.33.0 or before 1.24.7.
- Review RBAC for users allowed to deploy Kiali operands.
- Confirm operator service accounts do not expose unnecessary privileged tokens.
- Look for unexpected Kiali operand deployments or unapproved images.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-281: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-3495 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=1947361CVE reference · x_refsource_MISC
- https://kiali.io/news/security-bulletins/kiali-security-003/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Preservation of Permissions
Improper Preservation of Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.