Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.
The issue has been patched in v1.4.0
Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.
{ "nvd_published_at": null, "cwe_ids": [ "CWE-300" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-12-04T23:13:42Z" }