CVE-2024-30896

Deeper analysis

InfluxDB OSS 2.x through version 2.7.11 stores the administrative operator token under the default organization. This design allows any authorized user who possesses read access to the authorization resource of that default organization to retrieve the token. The issue does not affect InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated, or Clustered deployments.

An attacker with the described read permission on the default organization can obtain the operator token and thereby gain full administrative control over the InfluxDB instance. The researcher additionally notes that allAccess administrators can list all raw tokens using the “influx auth ls” command, amplifying the exposure when such accounts exist.

InfluxData states that the organizations feature behaves as intended and recommends placing users in non-default organizations to limit exposure. Version 2.8.0 removes the ability to retrieve tokens via the API, closing the reported vector. Public references include the vendor’s GitHub issue tracker, the 2.8.0 release notes, and a proof-of-concept repository describing the original finding. The associated EPSS score has remained in the 0.32–0.35 range without a pronounced post-disclosure climb.