CVE-2021-3051
Cortex XSOAR: Authentication Bypass in SAML Authentication
Reported by palo_alto · Published September 8, 2021
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Cortex XSOAR | Palo Alto Networks | 1578677, 1578666, 1578663, 1576452 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Cortex XSOAR | 5.5.0, 6.0.2, 6.1.0 |
| Palo Alto Networks | Cortex XSOAR | 5.5.0, 6.2.0, 6.0.2 |
Timeline
- Sep 8, 2021 CVE Published
- Sep 9, 2021 EPSS Score (30 in total, the first dated here)
- Sep 17, 2024 CVE Updated
- Apr 4, 2026 Security Advisory
- Aug 3, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-3051
vulnetix vdb fixes CVE-2021-3051Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-3051/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart