CVE-2024-30896: InfluxDB Information Disclosure Flaw

CVE-2024-30896 Overview

CVE-2024-30896 is a critical insecure storage of sensitive information vulnerability affecting InfluxDB OSS 2.x through version 2.7.11. The vulnerability allows authorized users with read access to the authorization resource of the default organization to retrieve the administrative operator token, which is improperly stored under the default organization. This misconfiguration enables privilege escalation by exposing the most powerful credential in the InfluxDB environment to lower-privileged administrators.

Critical Impact

Authorized users can retrieve the administrative operator token, potentially gaining full administrative control over the InfluxDB instance, including the ability to read, write, and delete all data across all organizations.

Affected Products

• InfluxDB OSS 2.x through 2.7.11
• InfluxDB OSS installations using default organization configuration

Discovery Timeline

• 2024-11-21 - CVE CVE-2024-30896 published to NVD
• 2025-12-19 - Last updated in NVD database

Technical Details for CVE-2024-30896

Vulnerability Analysis

This vulnerability is classified as CWE-922 (Insecure Storage of Sensitive Information). The core issue lies in how InfluxDB OSS 2.x manages and stores the administrative operator token. Rather than isolating this highly privileged credential, the system stores it under the default organization's authorization resources.

The operator token in InfluxDB represents the highest level of access—it can perform any operation across all organizations, including creating and deleting users, managing buckets, and accessing all data. When this token is accessible to users who only have read permissions on the authorization resource of the default organization, it creates a significant privilege escalation path.

The vendor has acknowledged this behavior, noting that the organizations feature is operating as designed and that administrators can choose to add users to non-default organizations as a workaround. However, this places the security burden on administrators who may not be aware of this architectural decision. The issue has been addressed in InfluxDB 2.8.0, which removes the ability to retrieve tokens from the API.

Root Cause

The root cause stems from an architectural design decision where the operator token is stored within the default organization's authorization namespace rather than being isolated in a separate, protected storage location. This design choice means any user granted read access to authorizations in the default organization inherits the ability to enumerate and retrieve all tokens, including the operator token. The influx auth ls command exposes these raw tokens to allAccess administrators, further compounding the issue.

Attack Vector

The attack vector requires network access and high privileges (read access to the default organization's authorization resource). An attacker who has been provisioned with read access to authorizations in the default organization can query the authorization API or use the influx auth ls command to enumerate available tokens. By retrieving the operator token, the attacker can escalate from a limited administrative role to full system control.

The attack flow involves an authenticated user with read permissions on the default organization's authorization resource making API calls to list authorizations, identifying the operator token among the returned results, and then using this token for subsequent requests with full administrative capabilities.

Detection Methods for CVE-2024-30896

Indicators of Compromise

• Unexpected API requests to authorization endpoints from users who should not require token enumeration
• Multiple token listing operations from a single user account in short succession
• Authentication using the operator token from unusual IP addresses or user agents
• Audit log entries showing operator token usage after authorization list queries

Detection Strategies

• Monitor InfluxDB API logs for requests to /api/v2/authorizations endpoints from non-administrative accounts
• Implement alerting on operator token usage patterns that deviate from baseline administrative activities
• Correlate authorization enumeration queries with subsequent privilege escalation activities
• Deploy network monitoring to detect unauthorized API access patterns to the InfluxDB instance

Monitoring Recommendations

• Enable comprehensive audit logging for all authorization-related API calls
• Establish baseline behavior for administrator token usage and alert on anomalies
• Regularly review which users have read access to the default organization's authorization resource
• Implement real-time alerting when the operator token is used outside of expected maintenance windows

How to Mitigate CVE-2024-30896

Immediate Actions Required

• Upgrade to InfluxDB OSS version 2.8.0 or later, which addresses this vulnerability by removing the ability to retrieve tokens from the API
• Review and restrict user access to the default organization, moving users to non-default organizations where possible
• Rotate the operator token after confirming no unauthorized access has occurred
• Audit authorization resource permissions and remove unnecessary read access from the default organization

Patch Information

InfluxData has released InfluxDB OSS version 2.8.0 to address this vulnerability. The fix removes the ability to retrieve tokens from the API, preventing the token exposure vector. Organizations should upgrade to this version or later. For additional details, refer to the InfluxDB Release Note v2.8.0. The GitHub Issue Discussion provides additional context on the vulnerability and remediation.

Workarounds

• Move users from the default organization to custom organizations to limit exposure of the operator token
• Implement strict role-based access control to prevent granting read access to authorization resources unnecessarily
• Use network segmentation to restrict which systems can access the InfluxDB API
• Deploy API gateway or proxy controls to filter and monitor authorization endpoint access

# Example: List current authorizations to audit token exposure (for administrators)
influx auth ls --org your-non-default-org

# Move users to a non-default organization to mitigate exposure
influx org members add --org custom-org --member user@example.com
influx org members remove --org default-org --member user@example.com