high 7.2

CVE-2021-20206 json

containernetworking/cni improper limitation of path name

published 2021-03-26 5 y ago modified 2026-09-10 1 mo ago also GHSA-xjqr-g762-pxwp , GO-2022-0230 , EUVD-2022-1255

cvss: 7.2; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits: 0; none known

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Patch / fix

fixed in 2 distros 5 links 1

go github.com/containernetworking/cni 0.8.1
linuxfoundation container_network_interface 0.8.1

debian suse opensuse alpine azure linux

golang-github-appc-cni Debian 14, Debian 13, Debian 12 0.8.1-1

debian advisories DEBIAN-CVE-2021-20206

podman SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +5 more 4.3.1-150300.9.15.1
podman SLE Module for Containers 15 SP4, SLE Micro 5.3, openSUSE Leap Micro 5.3 +1 more 4.3.1-150400.4.11.1
cni-plugins SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +24 more 0.8.6-150100.3.11.1
cni SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +24 more 0.7.1-150100.3.8.1
cni-plugins SLE Module for Public Cloud 15 0.8.6-150000.1.7.1
cni SLE Module for Public Cloud 15 0.7.1-150000.1.7.1
buildah SLE Module for Containers 15 SP3, openSUSE Leap 15.3 1.27.1-150300.8.11.1
libgpg-error SLE Module for Basesystem 15 SP3, SLE Micro 5.2, SLE Micro 5.1 +2 more 1.42-150300.9.3.1

suse advisories SUSE-SU-2023:0326-1 SUSE-SU-2023:0187-1 SUSE-SU-2022:4593-1 SUSE-SU-2022:4592-1 SUSE-SU-2022:4151-1 SUSE-SU-2022:4150-1

buildah openSUSE Tumbleweed 1.23.0-1.1
podman openSUSE Tumbleweed 4.2.0-2.1
cni openSUSE Tumbleweed 1.0.1-3.1
cni-plugins openSUSE Tumbleweed 1.1.1-2.1
buildah openSUSE Leap 15.3 1.23.1-150300.8.3.1

opensuse advisories openSUSE-SU-2024:10666-1 openSUSE-SU-2024:12371-1 openSUSE-SU-2024:12512-1 openSUSE-SU-2024:12513-1 openSUSE-SU-2022:0770-1

buildah Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.19.4-r0

alpine advisories ALPINE-CVE-2021-20206

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

buildah Azure Linux 3.0 1.41.4-2

azure linux advisories AZL-44838

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/containernetworking/cni#808 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20206 updated 2026-11-07 cvss 7.2

containernetworking-cni: Arbitrary path injection via type field in CNI configuration

Red Hat OpenShift Service Mesh 2.0 servicemesh-cni
affected: no fix available
Red Hat Enterprise Linux 7 podman, buildah, containernetworking-plugins
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +5 more
affected: no fix available, no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 3.11 atomic-openshift-cluster-autoscaler
affected: no fix planned “Will not fix”
Red Hat OpenShift Container Platform 4 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +12 more
affected: no fix available, no fix planned “Out of support scope”
Red Hat Openshift Container Storage 4 ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8, ocs4/rook-ceph-rhel8-operator
affected: no fix planned “Will not fix”
Red Hat OpenShift Virtualization 2 kubemacpool-container, ovs-cni-plugin-container, cnv-containernetworking-plugins-container
affected: no fix available, no fix planned “Will not fix”
Red Hat Quay 3 quay/quay-builder-rhel8
affected: no fix available

show 3 more

Red Hat OpenShift Container Platform 4.7 openshift4/ose-sriov-cni v4.7.0-202103270130.p0, openshift4/ose-docker-builder v4.7.0-202103270130.p0, openshift4/ose-sriov-infiniband-cni v4.7.0-202104281843.p0, openshift4-wincw/windows-machine-config-rhel8-operator 2.0.5-4, openshift4/ose-container-networking-plugins-rhel8 v4.7.0-202201261537.p0.ga3cf46b.assembly.stream
fixed: vendor fix RHSA-2022:1660
Red Hat OpenShift Container Platform 4.8 openshift4-wincw/windows-machine-config-rhel8-operator 3.0.0-16, openshift4/ose-docker-builder v4.8.0-202107152024.p0.git.70b7b95.assembly.stream, openshift4/ose-container-networking-plugins-rhel8 v4.8.0-202106291913.p0.git.a8801b0.assembly.stream
fixed: vendor fix RHSA-2021:3001
Red Hat Advanced Cluster Management for Kubernetes 2 cni Red Hat Enterprise Linux 9 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +4 more Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, containernetworking-cni, +8 more Red Hat OpenShift Container Platform 4 cri-o, openshift4/ose-sdn-rhel8, openshift4/ose-kube-proxy, openshift4/ose-ovn-kubernetes, openshift4/ose-hyperkube-rhel9, openshift4/ose-sriov-network-webhook, +3 more Red Hat OpenShift Container Platform 4.7 openshift4/ose-cli v4.7.0-202103270130.p0, openshift4/ose-pod v4.7.0-202103270130.p0, openshift4/ose-ptp v4.7.0-202103270130.p0, openshift4/ose-etcd v4.7.0-202103270130.p0, openshift4/ose-tests v4.7.0-202103270130.p0, openshift4/ose-console v4.7.0-202103261426.p0, +319 more Red Hat OpenShift Container Platform 4.8 openshift4-wincw/windows-machine-config-operator-bundle v3.0.0-17, openshift4/ose-cli v4.8.0-202106291725.p0.git.1077b05.assembly.stream, openshift4/ose-pod v4.8.0-202107161820.p0.git.051ac4f.assembly.stream, openshift4/ose-etcd v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream, openshift4/ose-tests v4.8.0-202107131424.p0.git.0d958c3.assembly.stream, openshift4/ose-console v4.8.0-202107010336.p0.git.188a490.assembly.stream, +135 more

+1 more productsfewer

Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.52% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/containernetworking/cni	<0.8.1	0.8.1

Affected products

n/a containernetworking-cni

Classification

Weakness

CWE-20 Improper Input Validation
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

github.com /containernetworking/cni/pull/808
web, patch
bugzilla.redhat.com /show_bug.cgi?id=1919391
web, issue-tracking, third-party-advisory
snyk.io /vuln/SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-20206
advisory
github.com /containernetworking/cni
package
pkg.go.dev /vuln/GO-2022-0230
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary