CVE-2024-28110

CVE-2024-28110 is a credential leakage vulnerability affecting the Go SDK for CloudEvents prior to version 2.15.2. Specifically, using cloudevents.WithRoundTripper with an authenticated http.RoundTripper inadvertently modifies http.DefaultClient, causing authentication tokens to be sent to arbitrary endpoints. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity, requiring no user interaction, and leading to high confidentiality impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.