Lack of websocket authentication in Lens causes remote code execution when visiting a malicious website

published 2022-01-10 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-31296

cvss: 8.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the victim's browser to Lens and so operate the local terminal feature. This would allow the attacker to execute arbitrary commands as the Lens user.

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.3	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	2.0	5.1	AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

Mirantis Lens

Classification

Weakness

CWE-287 Improper Authentication
CWE-346 Origin Validation Error

References

github.com /Mirantis/security/blob/main/advisories/0001.md
third-party-advisory

Sources

CVE List CVE-2021-44458
NVD CVE-2021-44458

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary