← Vulnerability feed

Vulnerability record · CVE-2024-36535 · published 24 July 2024

CVE-2024-36535: Layer5 meshery improper access control vulnerability

Layer5 · Meshery

Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

9.8 CVSS 3.1 Critical EPSS 0.48% · top 61.4% CWE-284 · Improper access control
9.8CVSS 3.1 base score
0.48%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://gist.github.com/HouqiyuA/2950c3993cdeff23afcbd73ba7a33879 Third Party Advisory
https://gist.github.com/HouqiyuA/2950c3993cdeff23afcbd73ba7a33879 Third Party Advisory

Track CVE-2024-36535 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-46575Layer5 meshery sql injection vulnerabilityA SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute a…EPSS 1.3%9.8CVE-2021-31856Layer5 Meshery REST API SQL injection via order parameterLayer5 Meshery 0.5.2 contains a SQL injection flaw in its REST API, specifically in the order parameter handled by GetMesheryPatterns in models/meshe…EPSS 75%analysed8.1CVE-2024-35181Layer5 meshery sql injection vulnerabilityMeshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL inj…EPSS 1.6%8.1CVE-2024-35182Layer5 meshery sql injection vulnerabilityMeshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL inj…EPSS 1.6%7.5CVE-2024-29031Layer5 meshery sql injection vulnerabilityMeshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL inj…EPSS 0.96%7.8CVE-2026-81963Windows Update Stack link-following privilege escalationWindows Update Stack resolves links improperly before accessing files, a link-following flaw (CWE-59) compounded by improper access control (CWE-284)…KEVEPSS 0.39%analysed10.0CVE-2026-21962Oracle HTTP Server and WebLogic Proxy Plug-in improper access controlOracle HTTP Server and the WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) contain an improper access control flaw (CWE-284) in suppor…KEVEPSS 71%analysed10.0CVE-2026-34908Ubiquiti UniFi OS improper access control allows unauthorized system changesUniFi OS devices contain an improper access control flaw (CWE-284) that lets a network-reachable actor make unauthorized changes to the system. The C…KEVEPSS 15%analysed

Source: NIST National Vulnerability Database (record CVE-2024-36535), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.