How severe is CVE-2021-42343?

CVE-2021-42343 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-42343 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-42343?

CVE-2021-42343 affects Anaconda Dask. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-42343?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2021-42343 published?

CVE-2021-42343 was published on 2021-10-26 and last updated on 2026-06-17.

CVE-2021-42343

CVE-2021-42343 is a critical-severity vulnerability in Anaconda Dask with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 6.8
EPSS exploit prediction: 3% (85th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Anaconda Dask
Published: 2021-10-26
Last modified: 2026-06-17

Description

An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.

Frequently asked questions

What is CVE-2021-42343?: An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.
How severe is CVE-2021-42343?: CVE-2021-42343 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-42343 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-42343?: CVE-2021-42343 affects Anaconda Dask. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-42343?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2021-42343 published?: CVE-2021-42343 was published on 2021-10-26 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:anaconda:dask:*:*:*:*:*:python:*:*

More vulnerabilities in Anaconda Dask

CVE-2026-23528 — Medium (CVSS 6.1): Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy,…

All CVEs affecting Anaconda Dask →