Read the docs
TI-2022-07568 Aliases CVE-2022-23509GHSA-89qm-wcmw-3mgg

Weave Gitops Run vulnerable to insecure communication

Priority LOW 34CWE-200Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. The communication between GitOps Run and the local S3 bucket is not encrypted. This allows privileged users or process to tap the local traffic to gain information permitting access to the s3 bucket. From that point, it would be possible to alter the bucket content, resulting in changes in the Kubernetes cluster's resources. There are no known workaround(s) for this vulnerability. This vulnerability has been fixed by commits ce2bbff and babd915. Users should upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed github.com/weaveworks/weave-gitops (Go): 0.12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
weaveworksweave-gitopsup to 0.11.0—No fix listedCNA
—github.com/weaveworks/weave-gitops (Go)before 0.12.00.12.0Patch availableGHSA-89qm-wcmw-3mgg
  • weave-gitops Vendorweaveworks Affected up to 0.11.0 Fixed in — No fix listed CNA
  • github.com/weaveworks/weave-gitops (Go) Vendor— Affected before 0.12.0 Fixed in 0.12.0 Patch available GHSA-89qm-wcmw-3mgg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:weave:weave_gitops:*:*:*:*:*:*:*:*before 0.12.0VulnerableWeave
  • cpe:2.3:a:weave:weave_gitops:*:*:*:*:*:*:*:* Versions before 0.12.0 Vulnerable ·Weave

Remediation

  • Fix · GHSA-89qm-wcmw-3mgg github.com/weaveworks/weave-gitops (Go) Fixed in 0.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23509
  2. 2026-10-03 Alias added: GHSA-89qm-wcmw-3mgg

References

Patch 2

Advisory 2

Other 1

  • TI-2022-16400 Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode CVSS 3.1CRITICAL 9.8
  • TI-2022-16401 Improper KubeConfig handling allows arbitrary code execution CVSS 3.1CRITICAL 9.8
  • TI-2022-13142 Weave GitOps leaked cluster credentials into logs on connection errors CVSS 3.1CRITICAL 9.0
  • TI-2022-07567 GitOps Run allows for Kubernetes workload injection CVSS 3.1HIGH 8.9
  • TI-2023-17072 Information Disclosure Vulnerability in Weave GitOps Terraform Controller CVSS 3.1HIGH 8.5
  • TI-2020-16099 Weave Net Pods running in host PID namespace can be used to escalate other Kubernetes vulnerabilities CVSS 3.1HIGH 8.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences