CVE-2021-27098: Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node
Summary
CVE-2021-27098: Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node. Affects github.com/spiffe/spire across 5 version ranges.
>= 0.8.1, < 0.8.5
>= 0.9.0, < 0.9.4
>= 0.10.0, < 0.10.2
>= 0.11.0, < 0.11.3
>= 0.12.0, < 0.12.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package github.com/spiffe/spire/pkg/server/endpoints/node is a component of SPIRE, a software tool used for securing application-to-application communication in a distributed system. This package provides the Legacy Node API, which allows agents to request X.509 certificates for SPIFFE IDs. SPIFFE IDs are unique identifiers used to authenticate and authorize entities within a trust domain. The Legacy Node API in versions 0.8.1 through 0.8.4 (and versions before 0.9.4, 0.10.2, 0.11.3, and 0.12.1) contains a vulnerability that can be exploited to issue X.509 certificates with unauthorized SPIFFE IDs. This vulnerability can potentially lead to impersonation attacks and unauthorized access to resources.
Vulnerability Detail
The vulnerability in the Legacy Node API of SPIRE allows specially crafted requests to the FetchX509SVID RPC to result in the issuance of X.509 certificates with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. However, certain controls are in place to prevent this vulnerability from being triggered. The caller must present a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID must belong to the same trust domain. The issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3, and 0.12.1. The fix enforces that the FetchX509SVID RPC only issues X.509 certificates with SPIFFE IDs that the agent is authorized to distribute. Additionally, a change has been made to improve the handling of file descriptors related to workload attestation in SPIRE Agent.
How To Fix
Latest published version: v1.15.5 as of 23 Oct 2026
go get github.com/spiffe/spire@v1.15.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.8.1, < 0.8.50.8.5go get github.com/spiffe/spire@v0.8.5 -
>= 0.9.0, < 0.9.40.9.4go get github.com/spiffe/spire@v0.9.4 -
>= 0.10.0, < 0.10.20.10.2go get github.com/spiffe/spire@v0.10.2 -
>= 0.11.0, < 0.11.30.11.3go get github.com/spiffe/spire@v0.11.3 -
>= 0.12.0, < 0.12.10.12.1go get github.com/spiffe/spire@v0.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been identified for this vulnerability. Upgrading to the patched versions is the recommended solution.
Conclusion
The vulnerability in the Legacy Node API of SPIRE can be mitigated by upgrading to the patched versions. It is recommended to upgrade to one of the following versions: 0.8.5, 0.9.4, 0.10.2, 0.11.3, or 0.12.1. These versions enforce proper authorization and prevent the issuance of X.509 certificates with unauthorized SPIFFE IDs. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/spiffe/spire →
FAQ
SPIRE is a software tool used for securing application-to-application communication in a distributed system. It provides a way to authenticate and authorize entities using SPIFFE IDs.
A SPIFFE ID is a unique identifier used to represent an entity within a trust domain. It is used for authentication and authorization purposes in SPIRE.
The Legacy Node API allows agents to request X.509 certificates for SPIFFE IDs. Agents must present a valid agent certificate and the requested SPIFFE ID must belong to the same trust domain.
This vulnerability can potentially lead to impersonation attacks and unauthorized access to resources. An attacker could exploit the vulnerability to obtain X.509 certificates with unauthorized SPIFFE IDs.
You can use the Vulert Playground at Vulert Scanner to check if your version of SPIRE is affected by this vulnerability. Simply provide your Gopkg.lock file to the playground and it will analyze it for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/spiffe/spire.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
