Skip to content
Fencer Intel
critical 9.3

CVE-2022-1996 json

Authorization Bypass Through User-Controlled Key in emicklei/go-restful

published 4y ago modified last mo. also GHSA-r48q-9g5r-8q2h , GO-2022-0619 , EUVD-2022-6141

cvss
9.3
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

Patch / fix

  • go github.com/emicklei/go-restful/v3 3.8.0
  • go github.com/emicklei/go-restful 2.16.0, 2.16.0+incompatible
  • emicklei emicklei/go-restful v3.8.0
  • golang-github-emicklei-go-restful Debian 14, Debian 13, Debian 12 3.10.2-1

debian advisories DEBIAN-CVE-2022-1996

  • openshift-serverless-clients serverless 1.0 1.3.1-4.el8
  • openshift-gitops-kam openshift gitops 1.9 1.9.0-102.el8
  • openshift-gitops-kam-redistributable openshift gitops 1.9 1.9.0-102.el8
  • openshift-gitops-kam openshift gitops 1.8 1.8.3-6.el8
  • openshift-gitops-kam-redistributable openshift gitops 1.8 1.8.3-6.el8

red hat advisories RHSA-2022:6042RHSA-2023:3557RHSA-2023:3229

  • aws-iam-authenticator SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +1 more 0.7.18-150000.1.17.1
  • containerd Linux Micro 6.0 1.7.21-1.1
  • aws-iam-authenticator SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 +4 more 0.5.3-150000.1.12.1
  • containerd SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +18 more 1.7.21-150000.117.1
  • containerd SLE Module for Containers 12 1.7.8-16.91.7
  • runc SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +19 more 1.1.10-150000.55.1
  • containerd SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +19 more 1.7.8-150000.103.1
  • helm SLE Module for Package Hub 15 SP4, SLE Module for Containers 15 SP4, openSUSE Leap 15.4 +1 more 3.10.3-150000.1.13.1

suse advisories SUSE-SU-2026:2643-1SUSE-SU-2025:20091-1SUSE-SU-2024:4329-1SUSE-SU-2024:3221-1SUSE-SU-2024:0799-1SUSE-SU-2023:4727-1

  • helm3 openSUSE Tumbleweed 3.19.2-1.1
  • containerd openSUSE Tumbleweed 1.7.17-2.1
  • trivy openSUSE Tumbleweed 0.30.2-1.1
  • helm openSUSE Tumbleweed 3.9.3-1.1
  • trivy Package Hub 15 SP3, openSUSE Leap 15.3 0.30.4-bp153.8.1
  • trivy Package Hub 15 SP4, openSUSE Leap 15.4 0.30.4-bp154.2.6.1

opensuse advisories openSUSE-SU-2025:15779-1openSUSE-SU-2024:14081-1openSUSE-SU-2024:12205-1openSUSE-SU-2024:12252-1openSUSE-SU-2022:10094-1openSUSE-SU-2022:10081-1

  • gitlab-runner Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 15.10.0-r0

alpine advisories ALPINE-CVE-2022-1996

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sriov-network-device-plugin Azure Linux 3.0 3.7.0-1

azure linux advisories AZL-41344

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-1996 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1996 updated cvss 9.1

go-restful: Authorization Bypass Through User-Controlled Key

  • Red Hat OpenShift Developer Tools and Services odo, helm
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless cli, knative-eventing knative-eventing Red Hat 3scale API Management Platform 2 3scale-rhel7-operator 3scale-rhel7-operator
    affected: no fix available
  • Red Hat Ansible Automation Platform 1.2 openshift-clients Red Hat Ansible Automation Platform 2 openshift-clients Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, ansible-service-broker, atomic-openshift-tests, atomic-openshift-master, +17 more Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, machine-config-daemon, openshift-kube-apiserver, +6 more Red Hat Openshift Container Storage 4 mcg Red Hat Openshift Data Foundation 4 mcg
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 kubevirt
    affected: no fix available
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/kubemacpool v4.9.7-4, container-native-virtualization/kubevirt-vmware v4.9.7-2, container-native-virtualization/virt-cdi-cloner v4.9.7-3, container-native-virtualization/libguestfs-tools v4.9.7-5, container-native-virtualization/kubevirt-ssp-operator v4.9.7-4, container-native-virtualization/vm-import-virtv2v-rhel8 v4.9.7-4, +5 more
    fixed: vendor fix RHSA-2022:8609
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 2.2.1-8, cryostat-tech-preview/jfr-datasource-rhel8 2.2.0-14, cryostat-tech-preview/cryostat-reports-rhel8 1.1.1-9, cryostat-tech-preview/cryostat-operator-bundle 2.2.1-8, cryostat-tech-preview/cryostat-rhel8-operator 2.2.1-11, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8 2.2.0-14
    fixed: vendor fix RHSA-2023:0814
  • Red Hat OpenShift GitOps 1.8 openshift-gitops-kam 1.8.3-6.el8, openshift-gitops-kam-redistributable 1.8.3-6.el8
    fixed: vendor fix RHSA-2023:3229
  • Red Hat OpenShift GitOps 1.9 openshift-gitops-kam 1.9.0-102.el8, openshift-gitops-kam-redistributable 1.9.0-102.el8
    fixed: vendor fix RHSA-2023:3557
show 3 more
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.3.1-4.el8
    fixed: vendor fix RHSA-2022:6042
  • Red Hat OpenShift Serverless 1.24 openshift-serverless-1/client-kn-rhel8 1.3.1-4, openshift-serverless-1/serving-queue-rhel8 1.3.0-3, openshift-serverless-1/eventing-mtping-rhel8 1.3.2-3, openshift-serverless-1/kourier-control-rhel8 1.3.0-2, openshift-serverless-1/serving-webhook-rhel8 1.3.0-3, openshift-serverless-1/eventing-webhook-rhel8 1.3.2-3, +32 more
    fixed: vendor fix RHSA-2022:6040
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virt-api v4.9.7-5, container-native-virtualization/virtio-win v4.9.7-3, container-native-virtualization/virt-handler v4.9.7-5, container-native-virtualization/bridge-marker v4.9.7-4, container-native-virtualization/virt-launcher v4.9.7-5, container-native-virtualization/virt-operator v4.9.7-5, +19 more Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-istioctl, servicemesh-pilot-agent, servicemesh-pilot-discovery Red Hat OpenShift Service Mesh 2.1 servicemesh, servicemesh-cni, servicemesh-prometheus, servicemesh-pilot-agent, servicemesh-pilot-discovery Red Hat OpenShift Container Platform 3.11 podman, atomic-openshift-web-console, openshift-enterprise-cluster-capacity Red Hat OpenShift Container Platform 4 cri-o
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.12% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • huntr.dev https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/emicklei/go-restful/v3
>=3.0.0, <3.8.0
3.8.0
go github.com/emicklei/go-restful
<2.16.0
<2.16.0+incompatible
2.16.0
2.16.0+incompatible
go github.com/emicklei/go-restful/v2
<=2.7.1
>=2.7.1
 no fix listed

Affected products

  • emicklei emicklei/go-restful

Classification

Weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.