# CVE-2024-21653: PYSEC-2026-2003 - vantage6 has insecure SSH configuration for node and server containers

Source: https://junglewise.ai/threats/cve-2024-21653-vantage6-insecure-ssh-configuration-in-node-and-server-containers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-21653 · Severity: low · CVSS 3.1 · Published 2026-07-07

vantage6 is a federated learning platform that provides node and server container images for collaborative data analysis. By default, these containers are configured with SSH enabled and allow root login with password authentication, which could allow unauthorized remote access if the SSH service is exposed to an untrusted network. In properly isolated deployments, this poses minimal risk; however, misconfigured deployments could result in complete system compromise.

Technologies: [vantage6 (PyPI)](https://junglewise.ai/threats/technologies/vantage6), [vantage6-node (PyPI)](https://junglewise.ai/threats/technologies/vantage6-node), [vantage6-server (PyPI)](https://junglewise.ai/threats/technologies/vantage6-server). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-21653 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-21653 being exploited in the wild.

**How severe is CVE-2024-21653?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** vantage6 (PyPI) ECOSYSTEM:introduced=0,fixed=4.2.0; vantage6-node (PyPI) GIT:introduced=0,fixed=3fcc6e6a8bd1142fd7a558d8fdd2b246e55c8841|ECOSYSTEM:introduced=0,fixed=4.2.0; vantage6-server (PyPI) GIT:introduced=0,fixed=3fcc6e6a8bd1142fd7a558d8fdd2b246e55c8841|ECOSYSTEM:introduced=0,fixed=4.2.0.

**Is there a fix for CVE-2024-21653?** Yes. vantage6 (PyPI): upgrade to 4.2.0 or later; vantage6-node (PyPI): upgrade to 4.2.0 or later; vantage6-server (PyPI): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-21653 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-21653?** Check whether you run vantage6 (PyPI), vantage6-node (PyPI) or vantage6-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vantage6 (PyPI): upgrade to 4.2.0 or later

  ```sh
  pip install "vantage6>=4.2.0"
  ```

- vantage6-node (PyPI): upgrade to 4.2.0 or later

  ```sh
  pip install "vantage6-node>=4.2.0"
  ```

- vantage6-server (PyPI): upgrade to 4.2.0 or later

  ```sh
  pip install "vantage6-server>=4.2.0"
  ```


## Technical details

This vulnerability stems from an insecure default SSH configuration in the Docker images for vantage6 node and server containers that permits password-based root login. The root cause is the overly permissive SSH settings intended for debugging purposes. The attack vector is network-based, requiring network connectivity to the SSH port (typically port 22); no authentication is required as the default configuration accepts password authentication for the root user. An attacker with network access to an exposed SSH service could gain root-level access to the container and underlying system. The vulnerability affects all versions prior to 4.2.0; the fix involves removing or restricting SSH configuration in the default container images.

## Affected products

- vantage6 vantage6 < 4.2.0

## Identifiers

- CVE-2024-21653
- GHSA-2wgc-48g2-cj5w
- PYSEC-2024-33
- PYSEC-2024-34
- PYSEC-2026-2003

## Timeline

- 2024-01-30: disclosed
- 2024-01-30: patched: Patched in version 4.2.0

## References

- [https://github.com/vantage6/vantage6/security/advisories/GHSA-2wgc-48g2-cj5w](https://github.com/vantage6/vantage6/security/advisories/GHSA-2wgc-48g2-cj5w)

## Related threats

- [PYSEC-2026-3703 - vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review](https://junglewise.ai/threats/cve-2026-73652-vantage6-algorithm-developer-can-edit-another-developer-s)
- [PYSEC-2026-2007 - vantage6 collaboration admins can extend their influence by expanding the collaboration](https://junglewise.ai/threats/cve-2024-32969-vantage6-collaboration-admins-can-extend-their-influence-by)
- [PYSEC-2026-2005 - vantage6 vulnerable to a username timing attack on recover password/MFA token](https://junglewise.ai/threats/cve-2024-24770-vantage6-vulnerable-to-a-username-timing-attack-on-recover)
- [PYSEC-2026-2004 - vantage6's CORS settings overly permissive](https://junglewise.ai/threats/cve-2024-23823-vantage6-s-cors-settings-overly-permissive)
- [PYSEC-2026-2008 - vantage6 vulnerable to username timing attack](https://junglewise.ai/threats/cve-2024-21671-vantage6-vulnerable-to-username-timing-attack)