LiveActive security incident?Get immediate response
CVE Record

CVE-2022-31145: Insufficient AccessToken Expiration Check in FlyteAdmin

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Users who use FlyteAdmin as the OAuth2 Authorization Server are unaffected by this issue. A patch is available on the `master` branch of the repository. As a workaround, rotating signing keys immediately will invalidate all open sessions and force all users to attempt to obtain new tokens. Those who use this workaround should continue to rotate keys until FlyteAdmin has been upgraded and hide FlyteAdmin deployment ingress URL from the internet.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

FlyteAdmin deployments using an external identity provider may accept access and ID tokens after expiration. An authenticated user could keep acting with an expired token, creating integrity risk in workflow administration. Deployments using FlyteAdmin itself as the OAuth2 Authorization Server are reported unaffected.

Executive priority

Treat as a moderate-priority identity and workflow-control issue. Prioritize exposed FlyteAdmin deployments using external identity providers, especially where workflow administration can change production data, jobs, or security-sensitive automation.

Technical view

CVE-2022-31145 is a CWE-613 token expiration validation flaw in flyteorg/flyteadmin versions 1.1.30 and earlier. Network access and low privileges are required. The CVSS 3.1 score is 6.5, driven by high integrity impact with no stated confidentiality or availability impact.

Likely exposure

Exposure is limited to FlyteAdmin versions 1.1.30 and earlier configured with an external identity provider. Internet-exposed FlyteAdmin ingress increases operational risk. The source bundle does not identify affected managed services, downstream distributions, or confirmed exploit volume.

Exploitation context

The record is not in KEV, and the provided sources do not claim active exploitation. Abuse requires an authenticated user and a previously issued token. The issue is session-continuation after expiry, not unauthenticated access.

Researcher notes

The affected condition is configuration-specific. The advisory states FlyteAdmin-as-OAuth2-server deployments are unaffected. Public source evidence names a master-branch patch and workaround, but the bundle does not provide a specific fixed release number or exploitation evidence.

Mitigation direction

  • Upgrade FlyteAdmin to a version containing PR #455/commit a1ec282, or follow current vendor guidance.
  • If immediate upgrade is impossible, rotate signing keys to invalidate open sessions.
  • Continue key rotation until upgrade completes, per advisory guidance.
  • Restrict or hide FlyteAdmin deployment ingress URL from the internet.
  • Confirm deployments using FlyteAdmin as OAuth2 Authorization Server are not affected.

Validation and detection

  • Inventory FlyteAdmin deployments and identify versions at or below 1.1.30.
  • Determine whether each deployment uses an external identity provider.
  • Confirm internet exposure of FlyteAdmin ingress and prioritize exposed instances.
  • In staging after upgrade, verify expired external IdP tokens are rejected.
  • Review session and authentication logs for suspicious expired-token activity if available.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-613: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-31145 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2022-31145Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
flyteorgflyteadmin<= 1.1.30Listed
Weakness

CWE details

CWE-613

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-613 · source CWE mapping

Insufficient Session Expiration

Insufficient Session Expiration represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs