Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server:
/-/config
/-/config
/-/config
./-/config
./agent/api/v1/configs/{name}
.Inline secrets will be exposed to anyone being able to reach these endpoints.
Secrets found in these sections are used for:
Non-inlined secrets, such as *_file
-based secrets, are not impacted by this vulnerability.
Download v0.20.1 or any version past v0.21.2 to patch Grafana Agent. These patches obfuscate the listed impacted secrets from the vulnerable endpoints.
The patches also disable the endpoints by default. Pass the command-line flag --config.enable-read-api
to opt-in and re-enable the endpoints.
If for some reason you cannot upgrade, use non-inline secrets where possible. Not all configuration options may have a non-inline equivalent.
You also may desire to restrict API access to Grafana Agent, with some combination of:
http_listen_address
in the server
block. 127.0.0.1
is the most restrictive, 0.0.0.0
is the default. { "nvd_published_at": "2021-12-08T17:15:00Z", "github_reviewed": true, "github_reviewed_at": "2021-12-08T19:32:31Z", "severity": "MODERATE", "cwe_ids": [ "CWE-200", "CWE-312" ] }