CVE-2023-46740 is a medium severity (CVSS 6.5) flaw in CubeFS before 3.3.1, where user access keys are made with an insecure random string generator. An attacker could guess a key and impersonate a user. Upgrade to 3.3.1, and consider rotating keys created by older versions.
What's affected
The record says versions prior to 3.3.1 are affected. The GitHub advisory GHSA-4248-p65p-hcrm says the same and lists the issue as fixed in v3.3.1. The advisory's patched versions field says none, but its text says v3.3.1 fixes it, so treat 3.3.1 as the fixed release.
Severity differs: the record scores 6.5 Medium while the GitHub advisory scores 5.5 Moderate with a different vector. The advisory says there is no other mitigation than upgrading. The weakness is CWE-330, insufficient randomness.
The NVD record scores it 6.5 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L. The weakness class is CWE-330 (insufficient randomness). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
For Go projects that import CubeFS as a module:
go list -m all | grep cubefs
For a running cluster, check the release version of each master and node. Anything below 3.3.1 is affected. Then list users created before the upgrade, since their keys came from the weak generator.
What to do now
- Upgrade CubeFS to 3.3.1 or later.
- Rotate access keys for users created under older versions, if your process allows it.
- Restrict network access to the CubeFS object and master endpoints.
- Review access logs for operations from unexpected users.
- Record the CubeFS version for each cluster.
Why it matters
Access keys act like passwords. If the generator behind them is predictable, an attacker who knows or observes the pattern can narrow the search space far below what the key length suggests. That is the class of mistake behind this CVE.
Upgrading fixes new keys, but it does not by itself change keys that already exist. That is why key rotation is worth considering after the update.
Quick check
Does upgrading change existing keys?
The advisory only says to upgrade. Rotating existing keys is a sensible extra step, but check the project guidance.
Is there a workaround?
No. The advisory says upgrading is the only mitigation.
Sources
Last reviewed: 19 October 2026.
