Vulnerability record · CVE-2021-41395 · published 18 September 2021

CVE-2021-41395: Goteleport teleport vulnerability

Goteleport · Teleport

Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or username.

6.5 CVSS 3.1 Medium EPSS 0.85% · top 43.5%

6.5CVSS 3.1 base score, v2 6.4

0.85%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or username.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Teleport Goteleport

References

Link	Tags
https://github.com/gravitational/teleport/releases/tag/v6.2.12	PatchRelease NotesThird Party Advisory
https://github.com/gravitational/teleport/releases/tag/v7.1.1	PatchRelease NotesThird Party Advisory
https://github.com/gravitational/teleport/releases/tag/v6.2.12	PatchRelease NotesThird Party Advisory
https://github.com/gravitational/teleport/releases/tag/v7.1.1	PatchRelease NotesThird Party Advisory

Track CVE-2021-41395 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-41393Goteleport teleport vulnerabilityTeleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.EPSS 1.1%18 Sep 2021 8.8CVE-2022-36633Teleport command injection via crafted SSH agent install linkTeleport 9.3.6 is vulnerable to OS command injection that leads to remote code execution. An attacker can URL-encode a bash escape sequence with carr…EPSS 50%analysed24 Aug 2022 6.5CVE-2022-38599Goteleport teleport exposure of resource to wrong sphere vulnerabilityTeleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface.EPSS 0.84%8 Dec 2022 5.3CVE-2021-41394Goteleport teleport vulnerabilityTeleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.EPSS 1.2%18 Sep 2021

Source: NIST National Vulnerability Database (record CVE-2021-41395), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.