CVE-2024-50312 Graphql: information disclosure via graphql introspection in openshift
Unauthorized users can retrieve GraphQL schema details via introspection, exposing application structure and increasing attack surface in OpenShift.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50312?
CVE-2024-50312 is a medium-severity vulnerability in Redhat Openshift Container Platform, published on 22 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.
Weakness: CWE-200
Which versions are affected by CVE-2024-50312?
1 open source package ship an affected version, including github.com/openshift/console. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openshift/console Go | All versions | None |
Products include Redhat Openshift Container Platform.
How do I fix CVE-2024-50312?
Apply the vendor's patch.
Is CVE-2024-50312 being exploited?
There is no known exploitation of CVE-2024-50312 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openshift Container Platform
- CVE-2020-27836 Missing authorization in cluster-ingress-operator
- CVE-2018-1085 Misconfiguration in openshift-ansible
- CVE-2026-54099 Privilege escalation in Red Hat OpenShift Container Platform 4
- CVE-2026-1784 Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection
- CVE-2021-20182 Privilege escalation in openshift
Sources
Also known as GHSA-7f25-p8gc-hxqh, GO-2024-3211.