CVE-2024-30896

What it actually does

The vulnerability permits any user with read access to the authorization resource in the default organization to retrieve the full administrative operator token via the API or influx auth ls command, bypassing intended token isolation.

Why it matters to the business

Compromise of the operator token grants complete control over the InfluxDB instance, enabling data exfiltration, modification, or denial of service; organizations running OSS 2.x through 2.7.11 face elevated risk of unauthorized administrative access, though the issue is not observed in ransomware campaigns and EPSS remains low with a slight downward trend.

How an attack unfolds

An attacker first obtains or is granted read permissions on the default organization's authorization resource, then issues a query to list authorizations (via API endpoint or influx auth ls) to extract the stored operator token; the token is subsequently used for any privileged operation, with the supplier noting this stems from design of the organizations feature and a future 2.x release removes token retrieval entirely.

How to fix it

Upgrade InfluxDB OSS 2.x to version 2.8.0 or the commit 40a633239e25dde9efcf0f21d5950897051cf8a9; alternatively restrict users to non-default organizations and avoid granting read access to the default organization's authorization resource until patched.

How to confirm the fix worked

Confirm the running version is 2.8.0 or newer; attempt to retrieve tokens via influx auth ls or the authorizations API endpoint while authenticated as a non-operator user and verify that raw operator tokens are no longer returned.

Typical attack path

1. Gain or possess read access to authorizations in the default organization
2. Execute influx auth ls or equivalent API call to enumerate tokens
3. Extract the operator token value from the response
4. Authenticate subsequent requests using the retrieved operator token for full administrative control

How to detect it

Search authentication and API logs for repeated or unexpected calls to authorization listing endpoints or influx auth ls invocations originating from non-operator accounts; correlate with subsequent high-privilege actions performed using tokens that were previously inaccessible.

What your security team should do

• Prioritize upgrade of all InfluxDB OSS 2.x instances to 2.8.0 within the next maintenance window
• Audit current user assignments and move non-administrative accounts out of the default organization
• Review and tighten read permissions on the authorization resource for the default organization
• Monitor for any post-upgrade regressions in token handling behavior