CVE-2022-46146 Prometheus Exporter Toolkit vulnerable to basic authentication bypass
Attackers with access to hashed passwords can bypass authentication in Prometheus exporters by poisoning the cache, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-46146?
CVE-2022-46146 is a medium-severity authentication bypass vulnerability in prometheus exporter-toolkit, published on 29 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
Which versions are affected by CVE-2022-46146?
5 open source packages ship an affected version, including github.com/prometheus/exporter-toolkit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/prometheus/exporter-toolkit Go | All versions | 0.7.2, 0.8.2 |
github.com/prometheus/exporter-toolkit Go | All versions | 0.7.2 |
github.com/prometheus/exporter-toolkit Go | All versions | 0.7.2 |
github.com/prometheus/exporter-toolkit Go | From 0.8.0 | 0.8.2 |
github.com/prometheus/exporter-toolkit Go | From 0.8.0 | 0.8.2 |
Linux distribution packages (17)
prometheus-ha_cluster_exporter SUSE:Linux Enterprise Module for SAP Applications 15 SP1 | All versions | 1.3.1+git.1676027782.ad3c0e9-150000.1.24.1 |
prometheus-ha_cluster_exporter SUSE:Linux Enterprise Module for SAP Applications 15 SP2 | All versions | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 |
prometheus-ha_cluster_exporter SUSE:Linux Enterprise Module for SAP Applications 15 SP3 | All versions | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 |
prometheus-ha_cluster_exporter SUSE:Linux Enterprise Module for SAP Applications 15 SP4 | All versions | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 |
prometheus-ha_cluster_exporter SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.3.1+git.1676027782.ad3c0e9-4.26.1 |
prometheus-ha_cluster_exporter SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.3.1+git.1676027782.ad3c0e9-4.26.1 |
golang-github-prometheus-prometheus SUSE:Manager Client Tools 12 | All versions | 2.32.1-1.41.1 |
golang-github-prometheus-prometheus SUSE:Manager Client Tools 15 | All versions | 2.32.1-150000.3.44.1 |
golang-github-prometheus-prometheus SUSE:Manager Proxy Module 4.2 | All versions | 2.32.1-150100.4.12.1 |
golang-github-prometheus-prometheus SUSE:Manager Proxy Module 4.3 | All versions | 2.32.1-150100.4.12.1 |
golang-github-prometheus-prometheus openSUSE:Leap 15.4 | All versions | 2.32.1-150100.4.12.1 |
prometheus-ha_cluster_exporter openSUSE:Leap 15.4 | All versions | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 |
golang-github-prometheus-prometheus openSUSE:Tumbleweed | All versions | 2.41.0-1.1 |
grafana openSUSE:Tumbleweed | All versions | 8.5.20-2.1 |
prometheus-blackbox_exporter openSUSE:Tumbleweed | All versions | 0.19.0-13.1 |
prometheus-ha_cluster_exporter openSUSE:Tumbleweed | All versions | 1.3.1+git.1676027782.ad3c0e9-2.1 |
prometheus-postgres_exporter openSUSE:Tumbleweed | All versions | 0.10.1-2.1 |
Products include Prometheus Exporter Toolkit.
How do I fix CVE-2022-46146?
Upgrade github.com/prometheus/exporter-toolkit to a fixed version for your release line: 0.7.2 or 0.8.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-46146 being exploited?
There is no known exploitation of CVE-2022-46146 in the wild and no public exploit code.
Sources
Also known as AZL-41992, CLEANSTART-2026-PO69653, DEBIAN-CVE-2022-46146, GHSA-7rg2-cxvp-9p7p, GO-2022-1130, SUSE-SU-2023:0460-1 and 11 more.