CVE-2018-12021: Singularity Incorrect Access Control
Summary
CVE-2018-12021: Singularity Incorrect Access Control. Affects github.com/hpcng/singularity versions >= 2.3.0, < 2.5.2. Fixed in 2.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Singularity is a Go package (github.com/hpcng/singularity) that provides a container platform for running applications in a secure and isolated environment. It supports overlay file systems, allowing users to layer additional file systems on top of the base system. This vulnerability affects Singularity versions 2.3.0 through 2.5.1 and is related to incorrect access control when using the overlay option. Malicious users can exploit certain Singularity features to gain unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in Singularity arises from an incorrect access control mechanism in systems that support overlay file systems. By leveraging specific Singularity features, a malicious user can bypass access restrictions and gain access to sensitive information. This can lead to unauthorized disclosure of confidential data and potential misuse of the compromised information. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: v3.1.1+incompatible as of 23 Oct 2026
go get github.com/hpcng/singularity@v3.1.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.2
This is the first release that contains the fix.
go get github.com/hpcng/singularity@v2.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Singularity.
Conclusion
The Singularity container platform is affected by an incorrect access control vulnerability, which can be exploited by malicious users to gain unauthorized access to sensitive information. To mitigate this risk, it is crucial to upgrade to Singularity version 2.5.2 or later. This updated version addresses the vulnerability by enforcing proper access controls. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hpcng/singularity →
FAQ
Singularity is a container platform that provides a secure and isolated environment for running applications.
Singularity versions 2.3.0 through 2.5.1 are affected by this vulnerability.
The vulnerability allows malicious users to bypass access controls and gain unauthorized access to sensitive information.
Yes, upgrading to Singularity version 2.5.2 or later fixes the vulnerability.
No, there are no known workarounds. Upgrading to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hpcng/singularity.
