CVE-2017-15103: Heketi Arbitrary Code Execution
Summary
CVE-2017-15103: Heketi Arbitrary Code Execution. Affects github.com/heketi/heketi versions < 5.0.1. Fixed in 5.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Heketi is a server API written in Go that manages the dynamic provisioning of storage volumes in a distributed storage system. It provides a RESTful interface for managing storage resources and is commonly used in container orchestration platforms. The vulnerability identified as CVE-2017-15103 allows an authenticated user to execute arbitrary code on the Heketi server, potentially leading to privilege escalation.
Vulnerability Detail
The security-check flaw in Heketi's server API enables an authenticated user to send specially crafted requests, resulting in remote command execution. This means that an attacker with valid credentials can execute arbitrary code on the Heketi server, potentially gaining unauthorized access and escalating their privileges. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: v10.3.0+incompatible as of 23 Oct 2026
go get github.com/heketi/heketi@v10.3.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.1
This is the first release that contains the fix.
go get github.com/heketi/heketi@v5.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Heketi package to the latest version to address the issue effectively.
Conclusion
The Heketi Arbitrary Code Execution vulnerability (CVE-2017-15103) allows an authenticated user to execute arbitrary code on the Heketi server, potentially leading to privilege escalation. It is crucial to update the Heketi package to version 5.0.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/heketi/heketi →
FAQ
Heketi is a server API written in Go that manages the dynamic provisioning of storage volumes in a distributed storage system. It provides a RESTful interface for managing storage resources.
The vulnerability allows an authenticated user to execute arbitrary code on the Heketi server, potentially leading to privilege escalation.
To fix this vulnerability, update the Heketi package to version 5.0.1 or later.
No, there is no known workaround for this vulnerability. Updating the package is the recommended solution.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/heketi/heketi.
