Common Weakness Enumeration
CWE-271 Privilege Dropping / Lowering Errors
Description
The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-271 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-55f6-4pr5-c7m5 | - | HIGH |
Kahi has privilege-drop and socket/log permission issues |
2026-06-30 | |
| GHSA-423p-g724-fr39 | CVE-2026-44477 | CRITICAL |
CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE |
2026-06-09 | |
| GHSA-vf6j-6739-78m8 | CVE-2023-22648 | HIGH |
Rancher's Azure AD permission changes are not reflected on active sessions |
2026-03-03 | |
| GHSA-gc2p-g4fg-29vh | CVE-2019-11243 | HIGH |
Kubernetes did not effectively clear service account credentials |
2025-04-24 |