CVE-2022-38599

MediumCVSS 6.5

Published: 08/12/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.78%

52th percentile - higher than 52% of all known CVEs

Summary

Teleport versions v3.2.2, v3.5.6-rc6, and v3.6.3-b2 were found to have an information leak through the /user/get-role-list web interface. The vulnerability allows unauthorized users to access the list of roles.

Risk Assessment

The risk involves exposure of sensitive information about the organization's permission structure, which could aid an attacker in planning further actions.

Recommendation

It is recommended to immediately update Teleport to the latest stable version that fixes this vulnerability. Also restrict access to the /user/get-role-list interface to trusted IP addresses only.

Original NVD description (English source)

Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface.