Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2024-56802

Tapir allows DeployKey exposure

Description

Tapir is a private Terraform registry. Tapir versions 0.9.0 and 0.9.1 are facing a critical issue with scope-able Deploykeys where attackers can guess the key to get write access to the registry. User must upgrade to 0.9.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PacoVK tapir

  • >= 0.9.0, < 0.9.2affected

References