{"id":"CVE-2022-46146","title":"exporter-toolkit: authentication bypass via cache poisoning (CVE-2022-46146)","summary":"A flaw was found in exporter-toolkit. A request can be forged by an attacker to poison the internal cache used to cache hashes and make subsequent successful requests. This cache is used to limit side channel attacks that could tell an att…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-305","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","affected":["enterprise_linux 9","openshift_container_platform 4","openshift_distributed_tracing 2","quay 3","openshift_container_platform 4.11","openshift_container_platform 4.12","openshift_container_platform 4.13"],"patched":["openshift_container_platform 4.11","openshift_container_platform 4.12","openshift_container_platform 4.13"],"published":"2022-11-29","updated":"2026-10-14","sourceUpdated":"2026-10-14T04:44:15+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-46146.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-46146.json"},{"url":"https://access.redhat.com/security/cve/CVE-2022-46146"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2149436"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46146"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46146"},{"url":"http://www.openwall.com/lists/oss-security/2022/11/29/1"},{"url":"http://www.openwall.com/lists/oss-security/2022/11/29/2"},{"url":"https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5"},{"url":"https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p"},{"url":"https://access.redhat.com/errata/RHSA-2023:5001"},{"url":"https://access.redhat.com/errata/RHSA-2023:2110"},{"url":"https://access.redhat.com/errata/RHSA-2023:1326"},{"url":"https://github.com/prometheus/exporter-toolkit/commit/25288779bc59d00c41b4a1706c6b87f0561ef2d7"},{"url":"https://github.com/prometheus/exporter-toolkit"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JRSHISR64L6QGSMDFZDNPHHIXSCAKK26"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UH24VXIB25OGHF4VGY4PLZMTGTI3BHCA"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULVDTAI76VATRAHTKCE2SUJ4NC3PQZ6Y"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JRSHISR64L6QGSMDFZDNPHHIXSCAKK26"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UH24VXIB25OGHF4VGY4PLZMTGTI3BHCA"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULVDTAI76VATRAHTKCE2SUJ4NC3PQZ6Y"},{"url":"https://security.gentoo.org/glsa/202401-15"},{"url":"http://www.openwall.com/lists/oss-security/2022/11/29/4"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.01262,"epssPercentile":0.69506,"aliases":["GHSA-7rg2-cxvp-9p7p","GO-2022-1130"],"ecosystem":"go","scores":{"vendor":7.5,"osv":6.2},"ingestedAt":"2026-09-12T03:13:01.765Z","slug":"CVE-2022-46146","body":"## Overview\n\nA flaw was found in exporter-toolkit. A request can be forged by an attacker to poison the internal cache used to cache hashes and make subsequent successful requests. This cache is used to limit side channel attacks that could tell an attacker if a user is present in the file or not. Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password. However, due to the way this mechanism was implemented in the exporter toolkit, if the hashed password is known, it is possible to authenticate against Prometheus.\n\n## Vendor advisories\n\n- **RHSA-2023:5001** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.11 · released 2023-09-13 · [advisory](https://access.redhat.com/errata/RHSA-2023:5001)\n- **RHSA-2023:2110** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2023-05-10 · [advisory](https://access.redhat.com/errata/RHSA-2023:2110)\n- **RHSA-2023:1326** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2023-05-17 · [advisory](https://access.redhat.com/errata/RHSA-2023:1326)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat OpenShift distributed tracing 2, Red Hat Quay 3 · no fix planned: Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat Quay 3, Red Hat OpenShift distributed tracing 2 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-46146.json)\n\n**exporter-toolkit: authentication bypass via cache poisoning** — rated Moderate by Red Hat. Released 2022-11-29, updated 2026-10-14.\n\nAffected:\n\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift distributed tracing 2\n- Red Hat Quay 3\n\nFixed:\n\n- Red Hat OpenShift Container Platform 4.11\n- Red Hat OpenShift Container Platform 4.12\n- Red Hat OpenShift Container Platform 4.13\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n- Red Hat Quay 3\n- Red Hat OpenShift distributed tracing 2\n\nNot affected:\n\n- Red Hat OpenShift Container Platform 4.11\n- Red Hat OpenShift Container Platform 4.12\n- Red Hat OpenShift Container Platform 4.13\n- Logging Subsystem for Red Hat OpenShift\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFor OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are\n\n      (… https://access.redhat.com/errata/RHSA-2023:5001\nFor OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html\n\nYou can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are:\n\n(For x… https://access.redhat.com/errata/RHSA-2023:2110\nFor OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags\n\nThe sha values for the release are:\n\n(For x8… https://access.redhat.com/errata/RHSA-2023:1326\n\n## Package advisory (CVE-2022-46146)\n\nAffected packages:\n\n- `github.com/prometheus/exporter-toolkit < 0.7.2`\n- `github.com/prometheus/exporter-toolkit >= 0.8.0, < 0.8.2`\n\nPatched in:\n\n- `github.com/prometheus/exporter-toolkit 0.7.2`\n- `github.com/prometheus/exporter-toolkit 0.8.2`\n\nSource: https://osv.dev/vulnerability/GHSA-7rg2-cxvp-9p7p","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[{"seq":220019,"id":"CVE-2022-46146","ts":1791978481718,"field":"cvss","old":"6.2","new":"7.5"},{"seq":220018,"id":"CVE-2022-46146","ts":1791978481718,"field":"severity","old":"medium","new":"high"}]}