> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/troubleshooting-and-resources/armory/general/cve-2021-43832-favexploit-spinnaker-rce-vulnerability-in-gate.md).

# CVE-2021-43832 - FavExploit- Spinnaker RCE Vulnerability in Gate

### Issue <a href="#issue" id="issue"></a>

Armory has since published updates to the code for OSS and Armory Enterprise. The [Spinnaker Security SIG](https://spinnaker.io/docs/community/security/) received a report of a previously undisclosed RCE attack vector that bypasses authentication in Spinnaker. This exploit allows an actor to make any resourced API call through Gate without authentication. The documented exploit affects any ***Spinnaker version within the last four years, but was only discovered on Dec 14th, 2021 Armory has created a placeholder CVE that has not been made public yet. We ask that customers upgrade to a version with the fix as soon as possible.*** \*\*\*Update Jan 3, 2022: \*\*\*The following CVE was published and made available today to the general public <https://cve.report/CVE-2021-43832> \*\*\*Update Oct 28, 2022: \*\*\*Added CVE# to title for formatting purposes.

### Cause <a href="#cause" id="cause"></a>

RCE attack vector discovered CVE-2021-43832 will be tracking this issue. This article will be updated with a link to the CVE once it has been made public