CVE-2023-24619

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-02-13 · updated 2026-06-17
Weakness: CWE-522

Description

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versions are 22.3.12, 22.2.10, and 22.1.12.

Affected products

Redpanda: from 22.1.0 before 22.1.12; from 22.2.0 before 22.2.10; from 22.3.0 before 22.3.12 — fixed in 22.1.12, 22.2.10, 22.3.12

How to fix

Upgrade to a fixed version: Redpanda 22.1.12, 22.2.10, 22.3.12. Check the vendor advisory for mitigations.

References

https://github.com/redpanda-data/redpanda/pull/8339
https://github.com/redpanda-data/redpanda/pull/8339

Get alerted when CVE-2023-24619 or the next vulnerability affects your stack