TI-2024-30761 Aliases CVE-2024-45794 GHSA-q78v-cv36-8fxj

SQL Injection in CreateUser API in devtron

HIGH 73CWE-89Published 2024-11-07 · Updated 2024-11-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00749 55th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed devtron (devtron-labs): 0.7.2github.com/devtron-labs/devtron (Go): 0.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
devtron-labs	devtron	before 0.7.2	0.7.2	Patch available	CNA
—	github.com/devtron-labs/devtron (Go)	before 0.7.2	0.7.2	Patch available	GHSA-q78v-cv36-8fxj

devtron Vendordevtron-labs Affected before 0.7.2 Fixed in 0.7.2 Patch available CNA
github.com/devtron-labs/devtron (Go) Vendor— Affected before 0.7.2 Fixed in 0.7.2 Patch available GHSA-q78v-cv36-8fxj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:devtron:devtron::::::kubernetes::*	before 0.7.2	Vulnerable	Devtron

cpe:2.3:a:devtron:devtron:*:*:*:*:*:kubernetes:*:* Versions before 0.7.2 Vulnerable ·Devtron

Remediation

Fix · CNA devtron (devtron-labs) Fixed in 0.7.2
Fix · GHSA-q78v-cv36-8fxj github.com/devtron-labs/devtron (Go) Fixed in 0.7.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-45794
2026-10-03 Alias added: GHSA-q78v-cv36-8fxj

References

Exploit 1

https://github.com/devtron-labs/devtron/security/advisories/GHSA-q78v-cv36-8fxj

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-45794

Other 2

TI-2026-57186 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences