Flyte Admin SQL Injection in List Filters

高 8.8CVE-2023-41891 · GHSA-r847-6w6h-r8g4 · GO-2023-2162 · 30/10/2023 公開 · 17/06/2026 更新

要点

CVE-2023-41891 は github.com/flyteorg/flyteadmin, flyteadmin (flyte) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 64.5% より高い）。
対処：1.1.124 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/flyteorg/flyteadmin Go	`< 1.1.124`	`1.1.124`
flyteadmin flyte	`< 1.1.124`	`1.1.124`

概要

Impact

List endpoints on Flyte Admin has a SQL vulnerability where a malicious user can send a REST requests with custom SQL statements as list filters.

Workarounds

The attacker needs to have access to the flyteadmin installation (typically either behind a VPN or authentication).

References

https://owasp.org/www-community/attacks/SQL_Injection#

NVD の説明

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.