CVE-2021-32835

CRITICAL

Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lead to post-authentication Remote Code e...

Affects 1 product across 1 vendor.

CVSS 3.19.9
EPSS4.6%
Percentile92th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-693: CWE-693
Related Attack Patterns (CAPEC)
CAPEC-51 Poison Web Service Registry
via CWE-693
CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
via CWE-693
CAPEC-59 Session Credential Falsification through Prediction
via CWE-693
CAPEC-65 Sniff Application Code
via CWE-693
CAPEC-107 Cross Site Tracing
via CWE-693
Show all 17

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A sandbox escape vulnerability in Eclipse Keti, a service designed for protecting RESTful APIs using Attribute Based Access Control (ABAC), may lead to post-authentication Remote Code Execution.

BSID: BS-2021-GLOBAL-276751-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-32835?
A sandbox escape vulnerability in Eclipse Keti, a service designed for protecting RESTful APIs using Attribute Based Access Control (ABAC), may lead to post-authentication Remote Code Execution.
What is the CVSS score for CVE-2021-32835?
CVE-2021-32835 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 4.6%.
Is CVE-2021-32835 actively exploited?
No confirmed active exploitation of CVE-2021-32835 as of 2026-09-25.
How do I remediate CVE-2021-32835?
Priority: IMMEDIATE.
What systems are affected by CVE-2021-32835?
CVE-2021-32835 affects Eclipse Keti.
Vulnerability Details
CVE IDCVE-2021-32835
BSIDBS-2021-GLOBAL-276751-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2021-09-09
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-693
SourceNVD
Official Description

Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lead to post-authentication Remote Code execution. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker with authenticated access to the Eclipse Keti service could exploit a sandbox escape vulnerability to execute arbitrary code on the host system.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Eclipse Keti No version listed by source
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1863 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashd3e0abe9521c7de9ae816d6ea39676fcf89db9ad1c3c2f3b8d78c6397bed185c8c3c7b9b753256cb15df3ceee890ccbff3492efe6ba3440e2df58895fb4f9b63
Related CVEs affecting Eclipse
CVE-2025-67109 10.0 Improper verification of the time certificate in Eclipse Cyclone DDS before v... CVE-2026-7411 10.0 In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadeq... CVE-2018-1000644 10.0 Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE... CVE-2021-32834 9.9 Eclipse Keti is a service that was designed to protect RESTfuls API using Att... CVE-2017-7657 9.8 In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9...
View all Eclipse CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →