Insufficient session expiration in Pinniped Supervisor
Priority LOW 25CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-613.
Summary
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.
Why it matters now
EPSS 0.00458 39th percentileScored 2026-11-07
Fix Fixed go.pinniped.dev (Go): 0.19.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Pinniped Supervisor | Pinniped Supervisor (before v0.19.0) | — | No fix listed | CNA |
| — | go.pinniped.dev (Go) | 0.3.0 to before 0.19.0 | 0.19.0 | Patch available | GHSA-rp4v-hhm6-rcv9 |
- Pinniped Supervisor Vendor— Affected Pinniped Supervisor (before v0.19.0) Fixed in — No fix listed CNA
- go.pinniped.dev (Go) Vendor— Affected 0.3.0 to before 0.19.0 Fixed in 0.19.0 Patch available GHSA-rp4v-hhm6-rcv9
Remediation
- Fix · GHSA-rp4v-hhm6-rcv9 go.pinniped.dev (Go) Fixed in 0.19.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31677
- 2026-10-03 Alias added: GHSA-rp4v-hhm6-rcv9
References
More VMware Pinniped vulnerabilities
- TI-2022-07151 Injection in Pinniped CVSS 3.1MEDIUM 6.6
Sources
- CVE-2022-31677 · CVE Program
- CVE-2022-31677 · NVD
- FIRST EPSS
- GHSA-rp4v-hhm6-rcv9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences