Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Swarm Plugin adds API endpoints to add or remove agent labels. In Swarm Plugin 3.20 and earlier these only require a global Swarm secret to use, and no regular permission check is performed. This allows users with Agent/Create permission to add or remove labels of any agent. Additionally, these API endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Swarm Plugin 3.21 requires POST requests and Agent/Configure permission for the affected agent to these endpoints. It no longer uses the global Swarm secret for these API endpoints.
Recommended action: Upgrade to 3.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Swarm Plugin adds API endpoints to add or remove agent labels. In Swarm Plugin 3.20 and earlier these only require a global Swarm secret to use, and no regular permission check is performed. This allows users with Agent/Create permission to add or remove labels of any agent. Swarm Plugin 3.21 requires Agent/Configure permission for the affected agent to these endpoints. It no longer uses the global Swarm secret for these API endpoints.
Recommended action: Upgrade to 3.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.