CVE-2024-32474 Sentry's superuser cleartext password leaked in logs
Sentry leaks superuser passwords in cleartext logs, allowing attackers with log access to gain administrative control.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-32474?
CVE-2024-32474 is a high-severity vulnerability in getsentry sentry, published on 18 Apr 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.
Which versions are affected by CVE-2024-32474?
3 open source packages ship an affected version, including sentry. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sentry PyPI | From 24.3.0 | 24.4.1 |
sentry PyPI | From 24.3.0 | 24.4.1 |
sentry PyPI | From 24.3.0 | 24.4.1 |
Products include Sentry Sentry.
How do I fix CVE-2024-32474?
Upgrade sentry to 24.4.1 or later.
Is CVE-2024-32474 being exploited?
There is no known exploitation of CVE-2024-32474 in the wild and no public exploit code.
Other vulnerabilities in getsentry sentry
- CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking
- CVE-2026-27197 Sentry: Improper Authentication on SAML SSO process allows user identity linking
- CVE-2021-47935 Sentry 8.2.0 Remote Code Execution via Pickle Deserialization
- CVE-2023-39349 Sentry vulnerable to privilege escalation via ApiTokensEndpoint
- CVE-2023-36826 Sentry vulnerable to improper authorization on debug and artifact file downloads
Sources
Also known as GHSA-6cjm-4pxw-7xp9, PYSEC-2026-1911.