Headline
GHSA-76cc-p55w-63g3: Teleport Access List owners can escalate their privileges
Impact
Access Lists are a new feature introduced in Teleport 14 and currently under preview. An issue was discovered that allows an Access List Owner to assign arbitrary permissions, including permissions to themselves which could result in privilege escalation.
Patches
Fixed in version 14.2.4 and 13.4.13
- GitHub Advisory Database
- GitHub Reviewed
- GHSA-76cc-p55w-63g3
Teleport Access List owners can escalate their privileges
Critical severity GitHub Reviewed Published Dec 29, 2023 in gravitational/teleport • Updated Jan 3, 2024
Package
gomod github.com/gravitational/teleport (Go)
Affected versions
>= 14.0.0, < 14.2.4
>= 13.0.0, < 13.4.13
Patched versions
14.2.4
13.4.13
Impact
Access Lists are a new feature introduced in Teleport 14 and currently under preview. An issue was discovered that allows an Access List Owner to assign arbitrary permissions, including permissions to themselves which could result in privilege escalation.
Patches
Fixed in version 14.2.4 and 13.4.13
References
- GHSA-76cc-p55w-63g3
Published to the GitHub Advisory Database
Jan 3, 2024