Description
Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cobbler | cobbler | >= 3.0.0, < 3.2.3, >= 3.3.0, < 3.3.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | cobbler | 3.3.7-bp156.2.6.1 | openSUSE-SU-2024:0370-1 |
| SUSE Package Hub 15 SP5 | cobbler | 3.3.7-bp155.2.3.2 | openSUSE-SU-2024:0382-1 |
| SUSE Manager Server Module 4.3 | cobbler | 3.3.3-150400.5.52.3 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | grafana-formula | 0.11.0-150400.3.21.4 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | inter-server-sync | 0.3.5-150400.3.36.13 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | saltboot-formula | 0.1.1723628891.ffb1da5-150400.3.18.4 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | spacecmd | 4.3.29-150400.3.42.8 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | spacewalk-backend | 4.3.30-150400.3.47.16 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | spacewalk-certs-tools | 4.3.26-150400.3.36.7 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | spacewalk-client-tools | 4.3.21-150400.3.33.11 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | spacewalk-config | 4.3.14-150400.3.18.6 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | spacewalk-java | 4.3.82-150400.3.96.1 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | spacewalk-utils | 4.3.22-150400.3.29.2 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | spacewalk-web | 4.3.42-150400.3.52.1 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | susemanager | 4.3.39-150400.3.58.5 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | susemanager-build-keys | 15.4.10-150400.3.29.4 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | susemanager-docs_en | 4.3.14-150400.9.66.2 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | susemanager-schema | 4.3.27-150400.3.45.11 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | susemanager-sls | 4.3.45-150400.3.55.4 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | susemanager-sync-data | 4.3.21-150400.3.35.2 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | uyuni-common-libs | 4.3.11-150400.3.21.6 | SUSE-SU-2024:4006-1 |
| SUSE Manager Server Module 4.3 | uyuni-reportdb-schema | 4.3.11-150400.3.18.12 | SUSE-SU-2024:4006-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.14-150400.3.122.1 | SUSE-SU-2024:4007-1 |
| SUSE Manager Proxy Module 4.3 | mgr-daemon +1 | 4.3.11-150400.3.21.6 | SUSE-SU-2024:4006-1 |
| SUSE Manager Proxy Module 4.3 | spacecmd | 4.3.29-150400.3.42.8 | SUSE-SU-2024:4006-1 |
| SUSE Manager Proxy Module 4.3 | spacewalk-backend | 4.3.30-150400.3.47.16 | SUSE-SU-2024:4006-1 |
| SUSE Manager Proxy Module 4.3 | spacewalk-certs-tools | 4.3.26-150400.3.36.7 | SUSE-SU-2024:4006-1 |
| SUSE Manager Proxy Module 4.3 | spacewalk-client-tools | 4.3.21-150400.3.33.11 | SUSE-SU-2024:4006-1 |
| SUSE Manager Proxy Module 4.3 | spacewalk-proxy | 4.3.19-150400.3.29.9 | SUSE-SU-2024:4006-1 |
| SUSE Manager Proxy Module 4.3 | spacewalk-web | 4.3.42-150400.3.52.1 | SUSE-SU-2024:4006-1 |
| SUSE Manager Proxy Module 4.3 | susemanager-build-keys | 15.4.10-150400.3.29.4 | SUSE-SU-2024:4006-1 |
| SUSE Manager Proxy Module 4.3 | uyuni-proxy-systemd-services | 4.3.14-150000.1.27.4 | SUSE-SU-2024:4006-1 |
| SUSE Manager Proxy 4.3 | release-notes-susemanager-proxy | 4.3.14-150400.3.90.1 | SUSE-SU-2024:4007-1 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-proxy-systemd-services | 4.3.14-150000.1.27.4 | SUSE-SU-2024:4006-1 |
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 4.3.14-150000.1.27.4 | SUSE-SU-2024:4006-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cobbler | 3.3.7-1.1 | openSUSE-SU-2024:14512-1 |
| openSUSE Leap 15.6 | cobbler | 3.3.7-bp156.2.6.1 | openSUSE-SU-2024:0370-1 |
| openSUSE Leap 15.5 | cobbler | 3.3.7-bp155.2.3.2 | openSUSE-SU-2024:0382-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
dollarboysushil/CVE-2024-47533-Cobbler-XMLRPC-Authentication-Bypass-RCE-Exploit-POC ★ 8 · Aug 12, 2025
CVE-2024-47533 is a critical authentication bypass vulnerability in Cobbler (versions 3.0.0 to before 3.2.3 and 3.3.7) allowing unauthenticated remote code execution via the XMLRPC interface.
-
baph00met/CVE-2024-47533 ★ 3 · Aug 11, 2025
CVE-2024-47533: Cobbler Authentication Bypass & Code Execution
-
okkotsu1/CVE-2024-47533 ★ 1 · Aug 14, 2025
-
zs1n/CVE-2024-47533 ★ 1 · Aug 13, 2025
PoC of CVE-2025-47533 Clobber RCE
-
00xCanelo/CVE-2024-47533-PoC ★ 1 · Aug 12, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Cobbler 'XML-RPC' - Authentication Bypass http/cves/2024/CVE-2024-47533.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cobbler | >= 3.3.0, < 3.3.7 | 3.3.7 | GHSA-m26c-fcgh-cp6h |
| PyPI | cobbler | >= 3.0.0, < 3.2.3 | 3.2.3 | GHSA-m26c-fcgh-cp6h |
| PyPI | cobbler | >= 3.0.0, < 3.2.3 · >= 3.3.0, < 3.3.7 | 3.2.3, 3.3.7 | PYSEC-2026-316 |
Advisories 6
- openSUSE-SU-2024:14512-1 cobbler-3.3.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0382-1 Security update for cobbler SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0370-1 Security update for cobbler SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3491 cobbler: Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · Aug 13, 2025
- SUSE-SU-2024:4006-1 Security update for SUSE Manager Server 4.3 SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2024:4007-1 Security update for SUSE Manager Server 4.3 SUSE / openSUSE Security Updates · May 2, 2025