TI-2022-13188 Aliases CVE-2022-31145 GHSA-qwrj-9hmp-gpxh

Insufficient AccessToken Expiration Check in FlyteAdmin

LOW 31CWE-613Published 2022-07-13 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Users who use FlyteAdmin as the OAuth2 Authorization Server are unaffected by this issue. A patch is available on the `master` branch of the repository. As a workaround, rotating signing keys immediately will invalidate all open sessions and force all users to attempt to obtain new tokens. Those who use this workaround should continue to rotate keys until FlyteAdmin has been upgraded and hide FlyteAdmin deployment ingress URL from the internet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01033 63rd percentileScored 2026-11-07

Fix Fixed github.com/flyteorg/flyteadmin (Go): 1.1.31

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
flyteorg	flyteadmin	up to 1.1.30	—	No fix listed	CNA
—	github.com/flyteorg/flyteadmin (Go)	before 1.1.31	1.1.31	Patch available	GHSA-qwrj-9hmp-gpxh

flyteadmin Vendorflyteorg Affected up to 1.1.30 Fixed in — No fix listed CNA
github.com/flyteorg/flyteadmin (Go) Vendor— Affected before 1.1.31 Fixed in 1.1.31 Patch available GHSA-qwrj-9hmp-gpxh

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:flyte:flyteadmin::::::::	before 1.1.31	Vulnerable	flyteorg

cpe:2.3:a:flyte:flyteadmin:*:*:*:*:*:*:*:* Versions before 1.1.31 Vulnerable ·flyteorg

Remediation

Fix · GHSA-qwrj-9hmp-gpxh github.com/flyteorg/flyteadmin (Go) Fixed in 1.1.31 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-31145
2026-10-03 Alias added: GHSA-qwrj-9hmp-gpxh

References

Patch 2

Advisory 2

Other 3

TI-2023-22283 FlyteAdmin SQL Injection in List Filters CVSS 3.1HIGH 8.8
TI-2022-18649 Default OAuth Authorization Server secret in FlyteAdmin CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences