← Vulnerability feed

Vulnerability record · CVE-2022-38599 · published 8 December 2022

CVE-2022-38599: Goteleport teleport exposure of resource to wrong sphere vulnerability

Goteleport · Teleport

Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface.

6.5 CVSS 3.1 Medium EPSS 0.84% · top 43.8% CWE-668 · Exposure of resource to wrong sphere
6.5CVSS 3.1 base score
0.84%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
9 Jul 2026Last modified by NVD

Description

Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://gist.github.com/arleyna/20d858e11c48984d00926fa8cc0c2722 ExploitThird Party Advisory
https://gist.github.com/arleyna/20d858e11c48984d00926fa8cc0c2722 ExploitThird Party Advisory

Track CVE-2022-38599 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-41393Goteleport teleport vulnerabilityTeleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.EPSS 1.1%8.8CVE-2022-36633Teleport command injection via crafted SSH agent install linkTeleport 9.3.6 is vulnerable to OS command injection that leads to remote code execution. An attacker can URL-encode a bash escape sequence with carr…EPSS 50%analysed6.5CVE-2021-41395Goteleport teleport vulnerabilityTeleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name…EPSS 0.85%5.3CVE-2021-41394Goteleport teleport vulnerabilityTeleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2022-38599), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.