CVE-2024-8986 — Information Leakage in grafana-plugin-sdk-go
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git r…
Published: 2024-09-19 · CVSS: 9.1 · CVSS 4.0
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7