CVE-2021-40323: Cobbler XMLRPC log poisoning leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required and very high EPSS make this a top remediation priority.

What it is

Cobbler before 3.3.0 allows log poisoning through an XMLRPC method that writes attacker-controlled input into the logfile, which is then processed as a template. This template injection lets an unauthenticated network attacker turn logged content into code execution.

Impact

An attacker can execute arbitrary code on the Cobbler server, gaining full control of the provisioning host and any systems it manages.

Attack surface

Reached over the network through the XMLRPC interface; the CVSS vector shows no privileges or user interaction required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.868, 99.7th percentile), indicating elevated likelihood of exploitation; references are patch and release links only, with no public exploit tag.

What to do

• Upgrade Cobbler to 3.3.0 or later, applying commit d8f60bbf14a838c8c8a1dba98086b223e35fe70a.
• Restrict network access to the Cobbler XMLRPC endpoint to trusted management hosts only.
• Disable or firewall XMLRPC if it is not required in your deployment.
• Audit and sanitize any template or logfile processing paths that consume externally supplied data.
• Monitor Cobbler logs for injected template or code-like content.

Detection

• Review Cobbler logfiles for unexpected template syntax or code fragments.
• Alert on XMLRPC requests from untrusted or unusual source addresses.
• Monitor for unexpected child processes or command execution spawned by the Cobbler service.
• Track Cobbler version inventory to confirm hosts are on 3.3.0 or later.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.