Security readout for executives and security teams
Plain-English summary
Weave GitOps versions before 0.8.1-rc.6 could write registered Kubernetes cluster credentials into management-cluster logs after connection errors. Anyone able to read those pod logs, or external log storage if enabled, could obtain kubeconfigs and service account tokens and potentially control registered clusters.
Executive priority
Treat this as urgent for any affected deployment because it can convert log access into Kubernetes cluster control. Prioritize upgrade, log access review, and credential rotation where evidence of leakage exists.
Technical view
The issue is CWE-532: sensitive information written to logs. The client factory dumped cluster configuration, including plaintext service account tokens, when the cluster manager hit an API server connection error. The vendor fixed it in commit 567356f471353fb5c676c77f5abc2a04631d50ca and recommends Weave GitOps core 0.8.1-rc.6 or newer.
Likely exposure
Exposure is likely limited to organizations running Weave GitOps core before 0.8.1-rc.6 with registered Kubernetes clusters. Risk increases where Weave GitOps pod logs or centralized log stores are accessible beyond tightly trusted administrators.
Exploitation context
The bundle does not show KEV listing or active exploitation evidence. Exploitation depends on access to Weave GitOps pod logs or external log storage containing connection-error log output. The business impact is high because leaked kubeconfigs can enable management of registered clusters.
Researcher notes
The source bundle is specific about affected versions, trigger condition, leaked data, and fixed commit. It does not provide evidence of exploitation in the wild, and states no known workaround. Focus validation on version state, log exposure, and credential compromise assessment.
Mitigation direction
- Upgrade Weave GitOps core to 0.8.1-rc.6 or newer.
- Check the vendor advisory and fix commit for deployment-specific guidance.
- Restrict access to Weave GitOps pod logs and external log storage.
- Search historical logs for leaked kubeconfigs and service account tokens.
- Rotate any credentials found in logs.
- Reduce retention or exposure of sensitive operational logs where feasible.
Validation and detection
- Inventory Weave GitOps deployments and confirm deployed versions.
- Identify all registered clusters managed by affected Weave GitOps instances.
- Review pod and external logs for exposed kubeconfig or token material.
- Confirm log storage permissions are limited to authorized operators.
- Verify upgraded instances no longer log cluster configuration on connection errors.
- Confirm leaked credentials, if any, were revoked or rotated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-532: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-31098 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H2.36Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-xggc-qprg-x6mwCVE reference · x_refsource_CONFIRM
- https://github.com/weaveworks/weave-gitops/commit/567356f471353fb5c676c77f5abc2a04631d50caCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.