{"id":"CVE-2022-36633","aliases":["GHSA-6xf3-5hp7-xqqg"],"title":"Improper token validation leading to code execution in Teleport","summary":"Improper token validation leading to code execution in Teleport","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"gravitational","product":"github.com/gravitational/teleport","ecosystem":"go","affected":["github.com/gravitational/teleport < 8.3.17","github.com/gravitational/teleport >= 9.0.0, < 9.3.13","github.com/gravitational/teleport >= 10.0.0, < 10.1.2"],"patched":["github.com/gravitational/teleport 8.3.17","github.com/gravitational/teleport 9.3.13","github.com/gravitational/teleport 10.1.2"],"published":"2022-08-25","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6xf3-5hp7-xqqg","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36633"},{"url":"https://github.com/gravitational/teleport/pull/14726"},{"url":"https://github.com/gravitational/teleport/pull/14726/commits/46c23b9b64b944d1e82d2c8a79083f291ffdd3b6"},{"url":"https://github.com/gravitational/teleport"},{"url":"https://github.com/gravitational/teleport/releases/tag/v10.1.2"},{"url":"https://github.com/gravitational/teleport/releases/tag/v8.3.17"},{"url":"https://github.com/gravitational/teleport/releases/tag/v9.3.13"},{"url":"https://packetstormsecurity.com/files/168137/Teleport-9.3.6-Command-Injection.html"},{"url":"http://packetstormsecurity.com/files/168477/Teleport-10.1.1-Remote-Code-Execution.html"}],"tags":["osv","go","exploit-available"],"epss":0.50275,"epssPercentile":0.98889,"exploitAvailable":true,"ingestedAt":"2026-08-07T19:14:16.002Z","exploits":{"exploitdb":true,"checkedAt":"2026-09-21T15:25:29.559Z"},"slug":"CVE-2022-36633","body":"## Overview\n\nTeleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.\n\n## Affected packages\n\n- `github.com/gravitational/teleport < 8.3.17`\n- `github.com/gravitational/teleport >= 9.0.0, < 9.3.13`\n- `github.com/gravitational/teleport >= 10.0.0, < 10.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/gravitational/teleport 8.3.17`\n- `github.com/gravitational/teleport 9.3.13`\n- `github.com/gravitational/teleport 10.1.2`","depth":"midnight","depthScore":70,"depthScoreParts":{"impact":48.4,"likelihood":10.1,"exploitation":12,"ransomware":0},"changes":[]}