-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper CSR validation in trustd's certificate issuance flow. The pre-patch version of Registrator.Certificate in reg.go lacked: 1) Enforcement of server-auth-only key usage 2) Sanitization of organization fields in CSR subjects 3) Strict validation of certificate purposes. This allowed malicious CSRs to obtain client certificates with elevated privileges. The fix adds x509.Options constraints (KeyUsageDigitalSignature/ExtKeyUsageServerAuth), removes organization fields from CSRs, and adds proper error handling - all visible in the commit diff. The function's role in processing authentication-sensitive CSRs and the direct security-related changes in the patch confirm its vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/talos-systems/talos | go | < 1.2.2 | 1.2.2 |
hostPathClusters that don't run untrusted workloads are not affected.
Clusters with correct Pod Security configurations which don't allow hostPath mounts, and secure access to cloud metadata server (or machine configuration is not supplied via cloud metadata server) are not affected.
If you have any questions or comments about this advisory:
Ongoing coverage of React2Shell