Configuration API in EdgeXFoundry exposes message bus credentials to local unauthenticated users
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, the /api/v2/config endpoint exposes message bus credentials to local unauthenticated users. In security-enabled mode, message bus credentials are supposed to be kept in the EdgeX secret store and require authentication to access. This vulnerability bypasses the access controls on message bus credentials when running in security-enabled mode. (No credentials are required when running in security-disabled mode.) As a result, attackers could intercept data or inject fake data into the EdgeX message bus. Users should upgrade to EdgeXFoundry Kamakura release (2.2.0) or to the June 2022 EdgeXFoundry LTS Jakarta release (2.1.1) to receive a patch. More information about which go modules, docker containers, and snaps contain patches is available in the GitHub Security Advisory. There are currently no known workarounds for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| edgexfoundry | edgex-go | before 2.1.1 | 2.1.1 | Patch available | CNA |
| — | github.com/edgexfoundry/device-sdk-go/v2 (Go) | before 2.1.1 | 2.1.1 | Patch available | GHSA-g63h-q855-vp3q |
| — | github.com/edgexfoundry/app-functions-sdk-go/v2 (Go) | before 2.1.1 | 2.1.1 | Patch available | GHSA-g63h-q855-vp3q |
- edgex-go Vendoredgexfoundry Affected before 2.1.1 Fixed in 2.1.1 Patch available CNA
- github.com/edgexfoundry/device-sdk-go/v2 (Go) Vendor— Affected before 2.1.1 Fixed in 2.1.1 Patch available GHSA-g63h-q855-vp3q
- github.com/edgexfoundry/app-functions-sdk-go/v2 (Go) Vendor— Affected before 2.1.1 Fixed in 2.1.1 Patch available GHSA-g63h-q855-vp3q
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:edgexfoundry:edgex_foundry:*:*:*:*:*:*:*:* | before 2.1.1 | Vulnerable | edgexfoundry |
- cpe:2.3:a:edgexfoundry:edgex_foundry:*:*:*:*:*:*:*:* Versions before 2.1.1 Vulnerable ·edgexfoundry
Remediation
- Fix · CNA edgex-go (edgexfoundry) Fixed in 2.1.1
- Fix · GHSA-g63h-q855-vp3q github.com/edgexfoundry/device-sdk-go/v2 (Go) Fixed in 2.1.1 Advisory →
- Fix · GHSA-g63h-q855-vp3q github.com/edgexfoundry/app-functions-sdk-go/v2 (Go) Fixed in 2.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31066
- 2026-10-03 Alias added: GHSA-g63h-q855-vp3q
References
More edgexfoundry Edgex Foundry vulnerabilities
- TI-2021-12421 Improper access control in edgexfoundry edgex-go CVSS 3.1HIGH 8.3
- TI-2021-18110 Broken or risky cryptographic algorithm in edgexfoundry app-functions-sdk-go CVSS 3.1MEDIUM 5.7
Sources
- CVE-2022-31066 · CVE Program
- CVE-2022-31066 · NVD
- FIRST EPSS
- GHSA-g63h-q855-vp3q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences