CVE-2021-32834
Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending maliciou...
Affects 1 product across 1 vendor.
Attacker injects arbitrary code that is executed by the application process.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
CVE-2021-32834 affects Eclipse Keti, allowing users with the ability to create Policy Sets to execute arbitrary code by sending malicious Groovy scripts that escape the configured Groovy sandbox.
BSID: BS-2021-GLOBAL-074874-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-32834?
What is the CVSS score for CVE-2021-32834?
Is CVE-2021-32834 actively exploited?
How do I remediate CVE-2021-32834?
What systems are affected by CVE-2021-32834?
| CVE ID | CVE-2021-32834 |
|---|---|
| BSID | BS-2021-GLOBAL-074874-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Published | 2021-09-09 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.
Source: NIST NVD / MITRE CVE Database
An attacker with the capability to create Policy Sets in Eclipse Keti can craft and submit malicious Groovy scripts. These scripts, if not properly sandboxed, can execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or system compromise.
Exploitation Likelihood: HIGH
| Vendor | Product | Affected Versions |
|---|---|---|
| Eclipse | Keti | No version listed by source |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 84644e632ff90fed3044fb2b7de7d3d47cf3ba4a4db39b0caecb63837a739f1a24cb2e60ddf3b5bee0912662cb2b449c01e896cea7020d4bd453113009d12a18 |
Critical Severity - Know Your Exposure
A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →