{"cve":"CVE-2022-36633","nvd":{"published":"2022-08-24T13:15:08.130","modified":"2026-06-17T04:53:46.750","status":"Modified","description":"Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-78"],"references":["http://packetstormsecurity.com/files/168477/Teleport-10.1.1-Remote-Code-Execution.html","https://github.com/gravitational/teleport","https://packetstormsecurity.com/files/168137/Teleport-9.3.6-Command-Injection.html","http://packetstormsecurity.com/files/168477/Teleport-10.1.1-Remote-Code-Execution.html","https://github.com/gravitational/teleport"],"products":["goteleport:teleport"],"source":"nvd","synced_at":"2026-10-19T21:34:18.502168378+00:00"},"epss":{"cve":"CVE-2022-36633","score":0.50275,"percentile":0.98908,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-6xf3-5hp7-xqqg","url":"https://osv.dev/vulnerability/GHSA-6xf3-5hp7-xqqg","summary":"Improper token validation leading to code execution in Teleport","modified":"2026-08-07T08:12:02.121526161Z","packages":[{"ecosystem":"Go","name":"github.com/gravitational/teleport","purl":"pkg:golang/github.com/gravitational/teleport","ranges":["<8.3.17"],"fixed":["8.3.17"]},{"ecosystem":"Go","name":"github.com/gravitational/teleport","purl":"pkg:golang/github.com/gravitational/teleport","ranges":[">=9.0.0 <9.3.13"],"fixed":["9.3.13"]},{"ecosystem":"Go","name":"github.com/gravitational/teleport","purl":"pkg:golang/github.com/gravitational/teleport","ranges":[">=10.0.0 <10.1.2"],"fixed":["10.1.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}