Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2024-6535— Skupper: potential authentication bypass to skupper console via forged cookies

Quick assessment

Affected

Red Hat Service Interconnect 1.4 for RHEL 9

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Skupper Operator是Skupper开源的一个 Kubernetes 工具。 Skupper Operator 存在安全漏洞，该漏洞源于在某些情况下，攻击者通过特制的 cookie 可以绕过 Skupper 控制台的身份验证。

CVSS 5.3 · Medium EPSS 0.53% · P45 Updated Feb 26, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-6535

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Skupper: potential authentication bypass to skupper console via forged cookies

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1392

Source: CVE Program / CVE List V5

Vulnerability Title

Skupper Operator 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Service Interconnect 1.4 for RHEL 9	1.4.7-1 ~ *	`cpe:/a:redhat:service_interconnect:1.4::el9`
Red Hat	Service Interconnect 1.4 for RHEL 9	1.4.7-1 ~ *	`cpe:/a:redhat:service_interconnect:1.4::el9`
Red Hat	Service Interconnect 1 for RHEL 9	1.5.5-1 ~ *	`cpe:/a:redhat:service_interconnect:1::el9`
Red Hat	Service Interconnect 1 for RHEL 9	1.5.5-1 ~ *	`cpe:/a:redhat:service_interconnect:1::el9`
Red Hat	Red Hat Service Interconnect 1	-	`cpe:/a:redhat:service_interconnect:1`

II. Public POCs for CVE-2024-6535

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-6535

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-6535 (4)

https://access.redhat.com/security/cve/CVE-2024-6535 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2296024 issue-tracking x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4871 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4865 vendor-advisory x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2024-6535

IV. Related Vulnerabilities

Same weakness: CWE-1392