Remote Yes

Type Information disclosure

Description

A security issue has been found in Grafana Agent before version 0.21.2. Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server:

- Inline secrets for metrics instance configs in the base YAML file are exposed at /-/config
- Inline secrets for integrations are exposed at /-/config
- Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at /-/config.
- Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at /-/config.
- Inline secrets for metrics instance configs loaded from the scraping service are exposed at /agent/api/v1/configs/{name}.

Inline secrets will be exposed to anyone being able to reach these endpoints.

Secrets found in these sections are used for:

- Delivering metrics to a Prometheus Remote Write system
- Authenticating against a system for discovering Prometheus targets
- Authenticating against a system for collecting metrics (scrape_configs and integrations)
- Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode
- Authenticating against Kafka for receiving traces

Non-inlined secrets, such as *_file-based secrets, are not impacted by this vulnerability.

AVG-2614 grafana-agent 0.21.0-1 0.21.2-1 High Fixed

https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh