CVE-2022-36103

{
  "id": "CVE-2022-36103",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-36103",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T15:49:20.410326Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "siderolabs",
          "product": "talos",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.2.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-13T17:15:08.320",
  "references": [
    {
      "url": "https://github.com/siderolabs/talos/commit/9eaf33f3f274e746ca1b442c0a1a0dae0cec088f",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/siderolabs/talos/releases/tag/v1.2.2",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/siderolabs/talos/security/advisories/GHSA-7hgc-php5-77qq",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/siderolabs/talos/commit/9eaf33f3f274e746ca1b442c0a1a0dae0cec088f",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/siderolabs/talos/releases/tag/v1.2.2",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/siderolabs/talos/security/advisories/GHSA-7hgc-php5-77qq",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR (certificate signing request) Talos control plane node might issue Talos API certificate which allows full access to Talos API on a control plane node. Accessing Talos API with full level access on a control plane node might reveal sensitive information which allows full level access to the cluster (Kubernetes and Talos PKI, etc.). Talos API join token is stored in the machine configuration on the worker node. When configured correctly, Kubernetes workloads don't have access to the machine configuration, but due to a misconfiguration workload might access the machine configuration and reveal the join token. This problem has been fixed in Talos 1.2.2. Enabling the Pod Security Standards mitigates the vulnerability by denying hostPath mounts and host networking by default in the baseline policy. Clusters that don't run untrusted workloads are not affected. Clusters with correct Pod Security configurations which don't allow hostPath mounts, and secure access to cloud metadata server (or machine configuration is not supplied via cloud metadata server) are not affected."
    },
    {
      "lang": "es",
      "value": "Talos Linux es una distribución de Linux construida para los despliegues de Kubernetes. Los nodos trabajadores de Talos usan un token de unión para ser aceptados en el clúster de Talos. Debido a una comprobación inapropiada de la petición mientras es firmado un CSR (solicitud de firma de certificado) de un nodo del plano de control de Talos, éste podría emitir un certificado de la API de Talos que permita el acceso completo a la API de Talos en un nodo del plano de control. El acceso a la API de Talos con acceso de nivel completo en un nodo del plano de control podría revelar información confidencial que permite el acceso de nivel completo al clúster (Kubernetes y Talos PKI, etc.). El join token de la API Talos es almacenado en la configuración de la máquina en el nodo trabajador. Cuando es configurado correctamente, las cargas de trabajo de Kubernetes no presentan acceso a la configuración de la máquina, pero debido a una mala configuración la carga de trabajo podría acceder a la configuración de la máquina y revelar el token de unión. Este problema ha sido corregido en Talos versión 1.2.2. La habilitación de las normas de seguridad de los pods mitiga la vulnerabilidad al denegar por defecto los montajes hostPath y las redes de host en la política de línea de base. Los clusters que no ejecutan cargas de trabajo no confiables no están afectados. Los clusters con configuraciones correctas de Pod Security que no permiten montajes hostPath, y acceso seguro al servidor de metadatos de la nube (o la configuración de la máquina no es suministrada por medio del servidor de metadatos de la nube) no están afectados"
    }
  ],
  "lastModified": "2026-06-17T04:52:55.647",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siderolabs:talos_linux:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9ADDE288-8867-4711-B46C-0D86BC9F2130",
              "versionEndExcluding": "1.2.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}