CVE-2021-41767: Apache Guacamole

Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days.

Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.

Affected products

• Apache Guacamole: up to and including 1.3.0

Published 2022-01-11. Last modified 2026-06-17.