VYPR
← All advisories
High severityNVD Advisory· Published Mar 26, 2021· Updated Aug 3, 2024

CVE-2021-20206

CVE-2021-20206

Description

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A path traversal vulnerability in containernetworking/cni before 0.8.1 allows attackers to execute arbitrary binaries by injecting '../' sequences in the network configuration 'type' field.

Vulnerability

Overview

The vulnerability is an improper limitation of path name in the containernetworking/cni library (versions before 0.8.1). When loading a network plugin, the 'type' field in the network configuration is used to specify the plugin binary. The library fails to sanitize path separators such as "../", allowing an attacker to reference binaries outside the intended plugin directory [1][2][3].

Exploitation

An attacker who can modify the network configuration (e.g., a privileged user or via a compromised container) can set the 'type' field to a path like "../../usr/bin/reboot". The CNI library will then execute that binary as a plugin. While adding network definitions is typically a privileged operation, the library's use in various Go binaries means the risk extends to any application that loads network configurations [4].

Impact

Successful exploitation allows execution of arbitrary existing binaries on the system, leading to potential compromise of confidentiality, integrity, and availability. For example, executing 'reboot' could cause denial of service [2][3].

Mitigation

The vulnerability is fixed in version 0.8.1. Users should upgrade to that version or later. Red Hat has acknowledged the issue and created tracking bugs for affected packages [4].

References
  1. GitHub - containernetworking/cni: Container Network Interface - networking for Linux containers
  2. NVD - CVE-2021-20206
  3. Snyk Vulnerability Database | Snyk
  4. Arbitrary path injection via type field in CNI configuration

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/containernetworking/cniGo
< 0.8.10.8.1

Affected products

98

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.