CRITICAL 9.1 Microsoft PoC
CVE-2024-30896
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API.
Microsoft Security Update 2026-Aug: InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API.
Affected Products
- cbl2 influxdb 2.6.1-22 on CBL Mariner 2.0
- cbl2 influxdb 2.6.1-23 on CBL Mariner 2.0
- cbl2 influxdb 2.6.1-24 on CBL Mariner 2.0
- cbl2 influxdb 2.6.1-30 on CBL Mariner 2.0
- azl3 influxdb 2.7.5-13 on Azure Linux 3.0
- azl3 influxdb 2.7.5-14 on Azure Linux 3.0
- azl3 influxdb 2.7.5-15 on Azure Linux 3.0
- azl3 influxdb 2.7.5-17 on Azure Linux 3.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30896
- https://nvd.nist.gov/vuln/detail/CVE-2024-30896
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-08-06 via Microsoft. 🚨 A public proof-of-concept exploit is available on GitHub. EPSS score: 5.2% (top 8% of all CVEs by exploitation probability). Affected: cbl2 influxdb 2.6.1-22 on CBL Mariner 2.0, cbl2 influxdb 2.6.1-23 on CBL Mariner 2.0, cbl2 influxdb 2.6.1-24 on CBL Mariner 2.0 and 5 more.
Risk Timeline
CVE Disclosed2026-08-06 · 3 days ago
Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible
Remediation Resources
Official Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30896NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2024-30896Related Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2025-49844 PoC | Redis Lua Use-After-Free may lead to remote code execution | CRITICAL | 9.9 |
| CVE-2024-36048 | QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2. | CRITICAL | 9.8 |
| CVE-2026-33937 | Handlebars.js has JavaScript Injection via AST Type Confusion | CRITICAL | 9.8 |
| CVE-2026-3381 | Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure ver | CRITICAL | 9.8 |
| CVE-2026-4176 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from | CRITICAL | 9.8 |
| CVE-2025-68615 | Net-SNMP snmptrapd crash | CRITICAL | 9.8 |
vulnfeed aggregates 8893 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.