CVE-2024-38487
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
The api-gateway container running with root privileges allows an attacker to escape the container and access the host system to perform unintended actions.
Risk Assessment
The risk associated with this vulnerability is the potential for an attacker to gain full control over the host system, leading to serious security breaches.
Recommendation
It is recommended to run containers with limited privileges and to regularly monitor and update security configurations.
Other vulnerabilities in api-gateway
See all- CVE-2026-110723High
In api-gateway versions till 1.7.3, the default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
- CVE-2026-110726Medium
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
- CVE-2026-110724High
In `api-gateway` versions up to `1.7.3`, the default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
- CVE-2026-11815Medium
An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution.
Original NVD description (English source)
api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS