CVE-2024-8996 Grafana Agent Flow on Windows Unquoted service path
Local attackers can escalate privileges to SYSTEM on Windows due to an unquoted service path in Grafana Agent Flow.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-8996?
CVE-2024-8996 is a high-severity vulnerability in Grafana Agent Flow, published on 25 Sep 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2
Weakness: CWE-428
Which versions are affected by CVE-2024-8996?
3 open source packages ship an affected version, including github.com/grafana/agent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/agent Go | All versions | 0.43.3 |
github.com/grafana/agent Go | All versions | 0.43.3 |
github.com/grafana/agent Go | All versions | 0.43.3 |
Products include Grafana Agent.
How do I fix CVE-2024-8996?
Upgrade github.com/grafana/agent to 0.43.3 or later.
Is CVE-2024-8996 being exploited?
There is no known exploitation of CVE-2024-8996 in the wild and no public exploit code.
Other vulnerabilities in Grafana Agent Flow
Sources
Also known as GHSA-m5gv-m5f9-wgv4, GO-2024-3170.