What’s Vulnerable › Vulnerabilities

CVE-2024-8986: Information Leakage in grafana-plugin-sdk-go

• Severity: critical (CVSS 9.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-19 · updated 2026-06-17
• Weakness: CWE-522

Description

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.

Affected products

• grafana-plugin-sdk-go Grafana Plugin SDK: from 0.106.0 through 0.249.0

References

• https://grafana.com/security/security-advisories/cve-2024-8986/

Get alerted when CVE-2024-8986 or the next vulnerability affects your stack