CVE-2020-35458: Clusterlabs Hawk

Critical severity, CVSS 9.8. EPSS: 5.6% chance of exploitation in the next 30 days.

An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.

Affected products

• Clusterlabs Hawk: version 2.2.0-12 only; version 2.3.0-12 only

Published 2021-01-12. Last modified 2026-06-17.