Mirantis develops container orchestration and runtime products spanning Lens, Bored Agent, and related platform extensions, with a narrow but strategically important footprint in cloud-native infrastructure. The recurring vulnerabilities center on access control, authentication, code injection, input validation, and OS command injection—attack vectors characteristic of management interfaces and container runtime boundaries where improper input handling and permission enforcement create elevated risk for lateral movement and privilege escalation in containerized environments.
The number and severity of CVEs published that impact products developed by Mirantis over time
Of all the CVEs published by Mirantis as a CNA, 100.0% affect products that Mirantis develops as a vendor.
Of all the CVEs published that affect products developed by Mirantis, 100.0% are self-published by Mirantis as a CNA.
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-44458CRITICAL Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the victim's browser to | Jan 10, 2022 | 9.6 | 29 | NO | NO |
CVE-2022-0484HIGH Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster | Feb 4, 2022 | 8.8 | 27 | NO | NO |
CVE-2021-23218HIGH When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a denial of service. | Jan 10, 2022 | 7.5 | 25 | NO | NO |
CVE-2021-23154HIGH In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments | Jan 10, 2022 | 7.8 | 25 | NO | NO |
CVE-2022-0270HIGH Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups. | Jan 25, 2022 | 8.8 | 22 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Mirantis.
Media articles that mention a CVE ID that affects a product developed by Mirantis — matched by CVE ID, not by vendor name.