CVE-2021-40325: Authorization Bypass in Cobbler
Summary
CVE-2021-40325: Cobbler before 3.3.0 allows authorization bypass for modification of settings. Affects cobbler across 2 version ranges.
< 3.3.0
< d8f60bbf14a838c8c8a1dba98086b223e35fe70a
Fixed in d8f60bbf14a838c8c8a1dba98086b223e35fe70a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cobbler is a package available on PyPI that provides a web interface for managing Linux installation servers. It is commonly used for network-based installations of operating systems. Cobbler allows administrators to modify various settings related to the installation process. However, prior to version 3.3.0, Cobbler was vulnerable to an authorization bypass issue, which could allow unauthorized users to modify these settings without proper authentication.
Vulnerability Detail
The vulnerability (CVE-2021-40325) in Cobbler allows unauthorized users to bypass the authorization mechanism and modify settings that should only be accessible to authenticated administrators. This could lead to unauthorized changes in the installation process, potentially resulting in security vulnerabilities or misconfigurations. The vulnerability was fixed in version 3.3.0 of Cobbler.
How To Fix
Latest published version: 3.3.10 as of 23 Oct 2026
pip install --upgrade "cobbler==3.3.10"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
d8f60bbf14a838c8c8a1dba98086b223e35fe70a
This is the first release that contains the fix.
pip install --upgrade "cobbler==d8f60bbf14a838c8c8a1dba98086b223e35fe70a"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerability (CVE-2021-40325) in Cobbler allows unauthorized users to bypass authorization and modify settings that should only be accessible to authenticated administrators. To fix the vulnerability, it is recommended to upgrade Cobbler to version 3.3.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for cobbler →
FAQ
The vulnerability allows unauthorized users to modify settings in Cobbler that should only be accessible to authenticated administrators. This could lead to unauthorized changes in the installation process, potentially resulting in security vulnerabilities or misconfigurations.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your version of Cobbler is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No specific workaround is available for this vulnerability. It is recommended to upgrade Cobbler to version 3.3.0 or later to fix the issue.
There are no known exploits for this vulnerability at the moment. However, it is important to address the issue promptly by upgrading Cobbler to the fixed version to prevent any potential unauthorized modifications.
You can find more information about this vulnerability in the advisory database maintained by the Python Packaging Authority (PyPA). The specific details of this vulnerability can be accessed from the following source: https://github.com/pypa/advisory-database/blob/main/vulns/cobbler/PYSEC-2021-375.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for cobbler.
