CVE-2022-3474: Bazel leaks user credentials through the remote assets API

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-26 · updated 2026-06-17
Weakness: CWE-522

Description

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

Affected products

Google LLC Bazel: from 3.1.0 before 4.2.3; from 5.0.0 before 5.3.2 — fixed in 4.2.3, 5.3.2

How to fix

Upgrade to a fixed version: Google LLC Bazel 4.2.3, 5.3.2. Check the vendor advisory for mitigations.

References

https://github.com/bazelbuild/bazel/security/advisories/GHSA-mxr8-q875-rhwq
https://github.com/bazelbuild/bazel/security/advisories/GHSA-mxr8-q875-rhwq

Get alerted when CVE-2022-3474 or the next vulnerability affects your stack