Vulnerability Spotlight: Command injection bug in Exhibitor UI

Summary: Logan Sanderson of Cisco ASIG discovered a command injection vulnerability in the Config editor of the Exhibitor Web UI, affecting versions 1.0.9 to 1.7.1. Arbitrary shell commands wrapped in backticks or $() can be inserted into the editor and are executed by the Exhibitor process when it launches ZooKeeper, letting an attacker run any command as the user running Exhibitor.
Bottom line: Exhibitor's Web UI has no authentication and, before version 1.7.0, no way to restrict which interfaces it listens on, so an exposed instance hands an attacker control over the ZooKeeper configuration and its stored keys and values. Cisco published the details without a patch from Exhibitor after a set deadline, leaving the exposure in place for anyone running an affected version.

Read the original at Cisco Talos ↗

Topics: Cloud Security
Related: Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026
New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026
Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage Cyber Risks ·