CVE catalog
CVE-2022-46146
golang-github-prometheus-exporter-toolkit: CVE-2022-46146
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.26% · Oct 25, 2026
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-github-prometheus-exporter-toolkit | sid | 0.17.1-1 | fixed |
| Debian | golang-github-prometheus-exporter-toolkit | forky | 0.17.1-1 | fixed |
| Debian | golang-github-prometheus-exporter-toolkit | trixie | 0.14.0-1 | fixed |
| Debian | golang-github-prometheus-exporter-toolkit | bookworm | 0.8.2-2 | fixed |
| Opensuse | golang-github-prometheus-prometheus | tumbleweed | 2.41.0-1.1 | fixed |
| Suse | golang-github-prometheus-prometheus | manager proxy module 4.2 | 2.32.1-150100.4.12.1 | fixed |
| Suse | golang-github-prometheus-prometheus | manager proxy module 4.3 | 2.32.1-150100.4.12.1 | fixed |
| Opensuse | golang-github-prometheus-prometheus | leap 15.4 | 2.32.1-150100.4.12.1 | fixed |
| Suse | release-notes-susemanager-proxy | manager proxy 4.3 | 4.3.6-150400.3.55.4 | fixed |
| Suse | release-notes-susemanager | manager server 4.3 | 4.3.6-150400.3.63.2 | fixed |
| Suse | golang-github-prometheus-prometheus | manager client tools 15 | 2.32.1-150000.3.44.1 | fixed |
| Opensuse | prometheus-ha_cluster_exporter | tumbleweed | 1.3.1+git.1676027782.ad3c0e9-2.1 | fixed |
| Opensuse | grafana | tumbleweed | 8.5.20-2.1 | fixed |
| Suse | release-notes-susemanager-proxy | manager proxy 4.2 | 4.2.13-150300.3.64.2 | fixed |
| Suse | release-notes-susemanager | manager server 4.2 | 4.2.13-150300.3.81.1 | fixed |
| Opensuse | prometheus-postgres_exporter | tumbleweed | 0.10.1-2.1 | fixed |
| Opensuse | prometheus-blackbox_exporter | tumbleweed | 0.19.0-13.1 | fixed |
| Suse | prometheus-ha_cluster_exporter | linux enterprise module for sap applications 15 sp2 | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 | fixed |
| Suse | prometheus-ha_cluster_exporter | linux enterprise module for sap applications 15 sp3 | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 | fixed |
| Suse | prometheus-ha_cluster_exporter | linux enterprise module for sap applications 15 sp4 | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 | fixed |
| Opensuse | prometheus-ha_cluster_exporter | leap 15.4 | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 | fixed |
| Suse | prometheus-ha_cluster_exporter | linux enterprise server for sap applications 12 sp4 | 1.3.1+git.1676027782.ad3c0e9-4.26.1 | fixed |
| Suse | prometheus-ha_cluster_exporter | linux enterprise server for sap applications 12 sp5 | 1.3.1+git.1676027782.ad3c0e9-4.26.1 | fixed |
| Suse | golang-github-prometheus-prometheus | manager client tools 12 | 2.32.1-1.41.1 | fixed |
| Suse | prometheus-ha_cluster_exporter | linux enterprise module for sap applications 15 sp1 | 1.3.1+git.1676027782.ad3c0e9-150000.1.24.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-github-prometheus-exporter-toolkit | source | sid | 0.8.2-1 | not yet assigned | Not reported | [1025127] |
| Debian | golang-github-prometheus-exporter-toolkit | source | forky | 0.8.2-1 | not yet assigned | Not reported | [1025127] |
| Debian | golang-github-prometheus-exporter-toolkit | source | trixie | 0.8.2-1 | not yet assigned | Not reported | [1025127] |
| Debian | golang-github-prometheus-exporter-toolkit | source | bookworm | 0.8.2-1 | not yet assigned | Not reported | [1025127] |
| Opensuse | golang-github-prometheus-prometheus | rpm | tumbleweed | 2.41.0-1.1 | Not reported | OPENSUSE-SU-2024:12650-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | manager proxy module 4.2 | 2.32.1-150100.4.12.1 | Not reported | SUSE-SU-2023:1859-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | manager proxy module 4.3 | 2.32.1-150100.4.12.1 | Not reported | SUSE-SU-2023:1859-1 | Not reported |
| Opensuse | golang-github-prometheus-prometheus | rpm | leap 15.4 | 2.32.1-150100.4.12.1 | Not reported | SUSE-SU-2023:1859-1 | Not reported |
| Suse | release-notes-susemanager-proxy | rpm | manager proxy 4.3 | 4.3.6-150400.3.55.4 | Not reported | SUSE-RU-2023:2592-1 | Not reported |
| Suse | release-notes-susemanager | rpm | manager server 4.3 | 4.3.6-150400.3.63.2 | Not reported | SUSE-RU-2023:2592-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | manager client tools 15 | 2.32.1-150000.3.44.1 | Not reported | SUSE-SU-2023:1857-1 | Not reported |
| Opensuse | prometheus-ha_cluster_exporter | rpm | tumbleweed | 1.3.1+git.1676027782.ad3c0e9-2.1 | Not reported | OPENSUSE-SU-2024:12691-1 | Not reported |
| Opensuse | grafana | rpm | tumbleweed | 8.5.20-2.1 | Not reported | OPENSUSE-SU-2024:12700-1 | Not reported |
| Suse | release-notes-susemanager-proxy | rpm | manager proxy 4.2 | 4.2.13-150300.3.64.2 | Not reported | SUSE-SU-2023:2594-1 | Not reported |
| Suse | release-notes-susemanager | rpm | manager server 4.2 | 4.2.13-150300.3.81.1 | Not reported | SUSE-SU-2023:2594-1 | Not reported |
| Opensuse | prometheus-postgres_exporter | rpm | tumbleweed | 0.10.1-2.1 | Not reported | OPENSUSE-SU-2024:12872-1 | Not reported |
| Opensuse | prometheus-blackbox_exporter | rpm | tumbleweed | 0.19.0-13.1 | Not reported | OPENSUSE-SU-2024:12904-1 | Not reported |
| Suse | prometheus-ha_cluster_exporter | rpm | linux enterprise module for sap applications 15 sp2 | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 | Not reported | SUSE-SU-2023:0465-1 | Not reported |
| Suse | prometheus-ha_cluster_exporter | rpm | linux enterprise module for sap applications 15 sp3 | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 | Not reported | SUSE-SU-2023:0465-1 | Not reported |
| Suse | prometheus-ha_cluster_exporter | rpm | linux enterprise module for sap applications 15 sp4 | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 | Not reported | SUSE-SU-2023:0465-1 | Not reported |
| Opensuse | prometheus-ha_cluster_exporter | rpm | leap 15.4 | 1.3.1+git.1676027782.ad3c0e9-150200.3.21.1 | Not reported | SUSE-SU-2023:0465-1 | Not reported |
| Suse | prometheus-ha_cluster_exporter | rpm | linux enterprise server for sap applications 12 sp4 | 1.3.1+git.1676027782.ad3c0e9-4.26.1 | Not reported | SUSE-SU-2023:0467-1 | Not reported |
| Suse | prometheus-ha_cluster_exporter | rpm | linux enterprise server for sap applications 12 sp5 | 1.3.1+git.1676027782.ad3c0e9-4.26.1 | Not reported | SUSE-SU-2023:0467-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | manager client tools 12 | 2.32.1-1.41.1 | Not reported | SUSE-SU-2023:1858-1 | Not reported |
| Suse | prometheus-ha_cluster_exporter | rpm | linux enterprise module for sap applications 15 sp1 | 1.3.1+git.1676027782.ad3c0e9-150000.1.24.1 | Not reported | SUSE-SU-2023:0460-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
Source package: [golang-github-prometheus-exporter-toolkit]
Details (2)
0.8.2-2· all · bookwormFixed · Fixed:
0.8.2-1dsa · golang-github-prometheus-exporter-toolkit · debian · bookworm
0.8.2-2· all · bookwormFixed · Fixed:
0.8.2-1dsa · golang-github-prometheus-exporter-toolkit · debian · bookworm
[openSUSE Tumbleweed]
Source package: [golang-github-prometheus-prometheus]
Details (1)
3.13.2-1.1· x86_64 · tumbleweedFixed · Fixed:
2.41.0-1.1dsa · golang-github-prometheus-prometheus · opensuse · tumbleweed
- [grafana]Fixed
Source package: [grafana]
Details (1)
12.4.5-4.1· x86_64 · tumbleweedFixed · Fixed:
8.5.20-2.1dsa · grafana · opensuse · tumbleweed
- [prometheus-blackbox_exporter]Fixed
Source package: [prometheus-blackbox_exporter]
Details (1)
0.26.0-7.3· x86_64 · tumbleweedFixed · Fixed:
0.19.0-13.1dsa · prometheus-blackbox_exporter · opensuse · tumbleweed
Source package: [prometheus-ha_cluster_exporter]
Details (1)
1.4.2-1.1· x86_64 · tumbleweedFixed · Fixed:
1.3.1+git.1676027782.ad3c0e9-2.1dsa · prometheus-ha_cluster_exporter · opensuse · tumbleweed
- [prometheus-postgres_exporter]Fixed
Source package: [prometheus-postgres_exporter]
Details (1)
0.10.1-6.4· x86_64 · tumbleweedFixed · Fixed:
0.10.1-2.1dsa · prometheus-postgres_exporter · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-el-9-client-tools-2023-2185.json]
- [https://osv.dev/vulnerability/SUSE-RU-2023:2592-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:0460-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:0465-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:0467-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:1857-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:1858-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:1859-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:2594-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12650-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12691-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12700-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12872-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12904-1]
- [https://security-tracker.debian.org/tracker/CVE-2022-46146]
- [https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-46146.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-2194.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]