Description
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | supervisor | 3.3.1-1.1 | — |
| Debian 13 | supervisor | 3.3.1-1.1 | — |
| Debian 12 | supervisor | 3.3.1-1.1 | — |
| Debian 9 | supervisor | 3.3.1-1+deb9u1 | DSA-3942-1 |
| Debian 8 | supervisor | 3.0r1-1+deb8u1 | DSA-3942-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | supervisor | 3.0a8-1.1+deb7u2 | DLA-1047-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | supervisor | 3.2.0-2ubuntu0.2 | — |
| Ubuntu 14.04 LTS | supervisor | 3.0b2-1ubuntu0.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | ansible-tower-setup +1 | 3.1.5-1.el7at | RHSA-2017:3005 |
| Red Hat CloudForms 5 | cfme +2 | 5.8.2.3-1.el7cf | RHSA-2017:3005 |
| Red Hat CloudForms 5 | rabbitmq-server | 3.6.9-1.el7at | RHSA-2017:3005 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-nokogiri +1 | 1.8.1-2.el7cf | RHSA-2017:3005 |
| Red Hat CloudForms 5 | supervisor | 3.1.4-1.el7 | RHSA-2017:3005 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | supervisor | 3.2.4-r0 | — |
| Alpine v3.23 | supervisor | 3.2.4-r0 | — |
| Alpine v3.22 | supervisor | 3.2.4-r0 | — |
| Alpine v3.21 | supervisor | 3.2.4-r0 | — |
| Alpine v3.20 | supervisor | 3.2.4-r0 | — |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | supervisor | 3.2.4-r0 | — |
| Alpine v3.18 | supervisor | 3.2.4-r0 | — |
| Alpine v3.17 | supervisor | 3.2.4-r0 | — |
| Alpine v3.16 | supervisor | 3.2.4-r0 | — |
| Alpine v3.15 | supervisor | 3.2.4-r0 | — |
| Alpine v3.14 | supervisor | 3.2.4-r0 | — |
| Alpine v3.13 | supervisor | 3.2.4-r0 | — |
| Alpine v3.12 | supervisor | 3.2.4-r0 | — |
| Alpine v3.11 | supervisor | 3.2.4-r0 | — |
| Alpine v3.10 | supervisor | 3.2.4-r0 | — |
| Alpine v3.9 | supervisor | 3.2.4-r0 | — |
| Alpine v3.8 | supervisor | 3.2.4-r0 | — |
| Alpine v3.7 | supervisor | 3.2.4-r0 | — |
| Alpine v3.6 | supervisor | 3.2.4-r0 | — |
| Alpine v3.5 | supervisor | 3.2.4-r0 | — |
| Alpine v3.4 | supervisor | 3.2.4-r0 | — |
| Alpine v3.3 | supervisor | 3.1.4-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Supervisor XML-RPC Authenticated Remote Code Execution
exploit/linux/http/supervisor_xmlrpc_exec
Exploit-DB 1
- Supervisor 3.0a1 < 3.3.2 - XML-RPC (Authenticated) Remote Code Execution (Metasploit) EDB-42779 · remote · Sep 25, 2017 · verified
GitHub 4 repositories
-
yaunsky/CVE-2017-11610 ★ 4 · Dec 22, 2020
Supervisord远程命令执行漏洞脚本
-
CyberCTF/vulhub-supervisor-cve-2017-11610 ★ 0 · Oct 8, 2026
Vulhub supervisor/CVE-2017-11610: Supervisord XML-RPC RCE (CVE-2017-11610), run with Isoloom
-
Dungsocool/CVE-2017-11610 ★ 0 · May 27, 2026
Lab 3: Supervisord XML-RPC Remote Code Execution (CVE-2017-11610) - Writeup and Exploit
-
ivanitlearning/CVE-2017-11610 ★ 0 · Nov 2, 2019
Standalone Python ≥3.6 RCE Unauthenticated exploit for Supervisor 3.0a1 to 3.3.2
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- XML-RPC Server - Remote Code Execution http/cves/2017/CVE-2017-11610.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | supervisor | < 3.0.1 | 3.0.1 | GHSA-x7c8-4x3h-874w |
| PyPI | supervisor | >= 3.1.0, < 3.1.4 | 3.1.4 | GHSA-x7c8-4x3h-874w |
| PyPI | supervisor | >= 3.2.0, < 3.2.4 | 3.2.4 | GHSA-x7c8-4x3h-874w |
| PyPI | supervisor | >= 3.3.0, < 3.3.3 | 3.3.3 | GHSA-x7c8-4x3h-874w |
| PyPI | supervisor | < 3.0.1 · >= 3.1, < 3.1.4 · >= 3.2, < 3.2.4 · >= 3.3, < 3.3.3 | 3.0.1, 3.1.4, 3.2.4, 3.3.3 | PYSEC-2017-41 |
Advisories 3
- RHSA-2017:3005 Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- DSA-3942-1 supervisor - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1047-1 supervisor - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2017:3005 vendor-advisory
- https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt
- https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt
- https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt
- FEDORA-2017-307eab89e1 vendor-advisory
- FEDORA-2017-85eb9f7a36 vendor-advisory
- https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt
- FEDORA-2017-713430fb15 vendor-advisory
- DSA-3942 vendor-advisory
- https://github.com/Supervisor/supervisor/issues/964
- 42779 exploit
- GLSA-201709-06 vendor-advisory