Skip to content
Fencer Vulns
medium 6.3

CVE-2021-3948 json

An incorrect default permissions vulnerability was found in the mig-controller.

published 2022-02-18 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-27158

cvss
6.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces handling an attacker may be able to migrate a malicious workload to the target cluster, impacting confidentiality, integrity, and availability of the services located on that cluster.

Patch / fix

  • konveyor mig-controller 1.5.2, 1.6.3
  • qemu Alpine 3.15 6.1.1-r0

alpine advisories ALPINE-CVE-2021-3948

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3948 updated cvss 6.3

mig-controller: incorrect namespaces handling may lead to not authorized usage of Migration Toolkit for Containers (MTC)

  • Red Hat Migration Toolkit 1.5 rhmtc/openshift-migration-controller-rhel8 v1.5.2-6
    fixed: vendor fix RHSA-2021:4848
  • Red Hat Migration Toolkit 1.6 rhmtc/openshift-migration-controller-rhel8 v1.6.3-8
    fixed: vendor fix RHSA-2022:0202
  • Red Hat Migration Toolkit 1.5 rhmtc/openshift-migration-ui-rhel8 v1.5.2-6, rhmtc/openshift-velero-plugin-rhel8 v1.5.2-3, rhmtc/openshift-migration-velero-rhel8 v1.5.2-4, rhmtc/openshift-migration-registry-rhel8 v1.5.2-4, rhmtc/openshift-migration-log-reader-rhel8 v1.5.2-4, rhmtc/openshift-migration-operator-bundle v1.5.2-15, +7 more Red Hat Migration Toolkit 1.6 rhmtc/openshift-migration-ui-rhel8 v1.6.3-6, rhmtc/openshift-velero-plugin-rhel8 v1.6.3-3, rhmtc/openshift-migration-velero-rhel8 v1.6.3-6, rhmtc/openshift-migration-registry-rhel8 v1.6.3-3, rhmtc/openshift-migration-rhel8-operator v1.6.3-10, rhmtc/openshift-migration-log-reader-rhel8 v1.6.3-3, +7 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • n/a mig-controller

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.