CVE-2020-11091: Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements
Summary
CVE-2020-11091: Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements in github.com/weaveworks/weave. Affects github.com/weaveworks/weave versions < 2.6.3+incompatible. Fixed in 2.6.3+incompatible. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/weaveworks/weave, which is written in Go. Weave Net is a networking solution that creates a virtual network that connects Docker containers across multiple hosts and enables communication between them. It provides features like DNS-based service discovery, network segmentation, and encryption. However, this package is vulnerable to a Man-in-the-Middle (MitM) attack through IPv6 rogue router advertisements.
Vulnerability Detail
The vulnerability in Weave Net allows an attacker to perform a MitM attack by sending rogue IPv6 router advertisements. These advertisements can be used to redirect network traffic to the attacker's machine, intercepting and potentially modifying the communication between containers. This can lead to unauthorized access, data leakage, or tampering of sensitive information. The vulnerability affects versions 0 to 2.6.2 of the package.
How To Fix
Latest published version: v2.6.5+incompatible as of 22 Oct 2026
go get github.com/weaveworks/weave@v2.6.5+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6.3+incompatible
This is the first release that contains the fix.
go get github.com/weaveworks/weave@v2.6.3+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Weave Net allows for a Man-in-the-Middle attack through IPv6 rogue router advertisements. It is crucial to update the package to version 2.6.3 or later to mitigate the risk of unauthorized access, data leakage, or tampering of sensitive information.
See every vulnerability recorded for github.com/weaveworks/weave →
FAQ
The vulnerability allows an attacker to perform a Man-in-the-Middle attack, potentially leading to unauthorized access, data leakage, or tampering of sensitive information.
Versions 0 to 2.6.2 of the package are affected.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities.
Yes, updating the package to version 2.6.3 or later will fix this vulnerability.
The fix in version 2.6.3 includes mitigations to prevent the acceptance of rogue router advertisements and ensures the integrity and confidentiality of network communications.
