cve/2024/CVE-2024-40632.md

### [CVE-2024-40632](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40632)
![](https://img.shields.io/static/v1?label=Product&message=linkerd2&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%20edge-24.6.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brighgreen)

### Description

Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/shutdown. Linkerd could introduce an optional environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that do not include this header. This issue has been addressed in release version edge-24.6.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

### POC

#### Reference
- https://github.com/linkerd/linkerd2/security/advisories/GHSA-6v94-gj6x-jqj7

#### Github
No PoCs found on GitHub currently.