CVE-2021-41767: Private tunnel identifier may be included in the non-private details of active conne

CVSS v3.1 base score:
CVSS v3.1 vector:

Software affected

  • Glyptodon Enterprise 1.15 and older
  • Glyptodon Enterprise 2.5 and older


Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.

Preconditions for exploitation

  • Multiple users that share access to the same connections, which are (1) already in use and (2) originally established using the HTTP tunnel instead of WebSocket.

Results of a successful attack

  • A user with access to a connection that is already in use by another user via the HTTP tunnel is able to read instantaneous blocks of transmitted connection data, as well as transmit data over that connection.


Both Glyptodon Enterprise 1.x and 2.x have been patched with respect to this vulnerability. Users should evaluate their exposure/risk based on this advisory and plan to upgrade when possible.

Analysis and CVSS score breakdown

Attack Vector
Exploiting this vulnerability relies only on communicating with the web application through standard mechanisms, as already exposed by Guacamole's web interface.
Attack Complexity
Exploiting this vulnerability requires limited technical ability, as the information in question is retrieved through standard mechanisms already exposed by Guacamole's web interface.
Privileges Required
Obtaining the information in question requires a user account with access to one or more connections. Information on active connection usage can be retrieved only for connections accessible by the user.
User Interaction
Another user must establish a connection before an attacker may attempt to exploit the issue.
The scope of information obtained does not extend beyond what Guacamole is explicitly designed to provide.
Confidentiality Impact
Retrievable information is limited to instantaneous data transmitted over an active connection that the current user may also access.
Writable/modifiable information is limited to interactive data transmitted over an active connection that the current user may also access.
The availability of Guacamole and all related services are unaffected.
Remediation Level
Official fix available
The upstream Apache Guacamole project has released a fix via their 1.4.0 release, and this fix has been backported to all affected versions of Glyptodon Enterprise.
Report Confidence
Existence of the vulnerability in Apache Guacamole 1.3.0 and older has been acknowledged by the upstream Apache Guacamole project.