CVE-2024-45340 GOAUTH credential leak in cmd/go
A malicious server can steal credentials from the user's .netrc file due to improper domain segmentation in the Go toolchain's GOAUTH feature.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45340?
CVE-2024-45340 is a high-severity vulnerability in cmd/go, published on 28 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.
Which versions are affected by CVE-2024-45340?
2 open source packages ship an affected version, including golang and toolchain.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | From 1.24.0-0 | 1.24.0-rc.2 |
toolchain Go | From 1.24.0-0 | 1.24.0-rc.2 |
How do I fix CVE-2024-45340?
Upgrade golang to 1.24.0-rc.2 or later.
Is CVE-2024-45340 being exploited?
There is no known exploitation of CVE-2024-45340 in the wild and no public exploit code.
Sources
Also known as BIT-golang-2024-45340, DEBIAN-CVE-2024-45340, ECHO-ba36-854d-9ccc, GHSA-v5qx-579h-rr6f, GO-2025-3383, UBUNTU-CVE-2024-45340.