CVE-2024-8986

CVE-2024-8986 describes a critical information disclosure vulnerability in the Grafana plugin SDK. When compiling plugins, the SDK embeds the full Git repository URI, including any embedded credentials, into the final binary. This allows for the exposure of sensitive authentication information if the repository URI contains them. With a CVSS score of 9.1 (CRITICAL), this vulnerability has a low attack complexity and can lead to high confidentiality and integrity impacts, as well as high availability impacts, without user interaction. The primary risk is the unauthorized access to private repositories or services due to exposed credentials. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, indicating a low level of public awareness at this time.