Skip to content
Fencer Vulns
critical 9.1

CVE-2024-30896 json

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with…

published 2024-11-21 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-28814

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
5.3%
EPSS 5.3% chance of exploitation in 30 days, percentile 92%
public exploits
1
Exploit-DB

Summary

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API. The supplier has stated that InfluxDB 2.8.0 has addressed this issue.

Patch / fix

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-30896 updated cvss 9.1

InfluxDB: Privilege Escalation via Authorization Token in InfluxDB

  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/prometheus-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/prometheus-rhel8, rhacm2/acm-grafana-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8 Red Hat OpenStack Platform 16.2 osp-director-provisioner-container
    affected: workaround, no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-52142)

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
23 mo ago

Exploit prediction

5.31% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52142 InfluxDB OSS 2.7.11 - Operator Token Privilege Escalation remote, 2025-04-08

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

  • influxdata influxdb

Classification

Weakness
  • CWE-922 Insecure Storage of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.