CVE-2022-26308

What it actually does

Authorization bypass in the credential store module permits a user holding the Operator (Write) role to create, delete, and view stored keys outside the scope of that role.

Why it matters to the business

Attackers who obtain limited operator accounts can harvest or manipulate credentials used to monitor and manage infrastructure, increasing the chance of lateral movement and broader system compromise.

How an attack unfolds

An attacker authenticates with an Operator (Write) account, navigates to the Configuration credential store endpoints, and issues HTTP requests that bypass intended role checks to list, add, or remove keys.

How to fix it

Upgrade Pandora FMS to the latest maintenance release that enforces proper role separation on the credential store; in the interim, restrict Operator (Write) accounts to the minimum necessary users and monitor credential-store access.

How to confirm the fix worked

After patching, create a test Operator (Write) account and confirm it can no longer list, create, or delete entries outside its intended scope; review role definitions in the Configuration section.

Typical attack path

1. Obtain or compromise an account assigned the Operator (Write) role
2. Authenticate to the Pandora FMS web interface
3. Send crafted requests to credential-store configuration endpoints
4. Create, view, or delete keys that should be restricted to higher-privileged roles
5. Use harvested credentials for further reconnaissance or access

How to detect it

Review web-server and application logs for repeated or anomalous requests to credential-store configuration URLs originating from accounts whose roles are limited to Operator (Write); correlate with successful additions or deletions of keys.

What your security team should do

• Apply the vendor fix as soon as a corrected build is available
• Audit all accounts with Operator (Write) privileges and reduce their number
• Enable and retain web-application and configuration-change logs for at least 90 days
• Add alerting on any modification of the credential store by non-admin roles