CVE-2017-11610: Supervisor XML-RPC server allows command execution via nested namespace lookups

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote authenticated command execution with a CVSS of 8.8, very high EPSS and a public exploit, though exploitation requires valid credentials and a reachable XML-RPC interface.

What it is

The XML-RPC server in Supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 permits remote authenticated users to execute arbitrary commands through a crafted XML-RPC request involving nested supervisord namespace lookups. Because Supervisor typically runs as a privileged process managing other services, command execution in that context is a serious escalation path. The record does not state which specific XML-RPC method is abused beyond the nested namespace lookup description.

Impact

An attacker with valid XML-RPC credentials gains arbitrary command execution with the privileges of the supervisord process, which is often root or a service account. That can lead to full control of the managed services and the host.

Attack surface

Reached over the network via the XML-RPC interface (CVSS vector AV:N); the attacker must authenticate (PR:L) and no user interaction is required (UI:N). Exposure depends on whether the XML-RPC listener is bound beyond localhost and reachable by the attacker.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.874, 99.7th percentile) and a public Exploit-DB entry (42779) exists, indicating mature public exploitation. No ransomware group usage is documented in the record.

What to do

• Upgrade Supervisor to 3.0.1, 3.1.4, 3.2.4, 3.3.3 or later as applicable to your branch, and apply the referenced Debian, Red Hat and Gentoo advisories.
• Restrict the XML-RPC listener to localhost or a trusted management network and block external access to its port.
• Use strong, unique XML-RPC credentials and avoid reusing them; rotate any credentials that may have been exposed.
• Run supervisord with the least privilege needed rather than as root where the deployment allows it.
• Monitor and alert on unexpected XML-RPC requests or child process spawns from supervisord.

Detection

• Inspect supervisord and XML-RPC access logs for requests containing nested namespace or dotted method names that deviate from normal client behavior.
• Alert on new or unusual child processes spawned by the supervisord process, especially shells or command interpreters.
• Hunt for outbound connections or file writes originating from the supervisord process that do not match its normal management activity.
• Review XML-RPC client source IPs for connections from hosts that do not normally manage Supervisor.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.