CVE Daily – InfluxDB (High+Critical) https://cvedaily.com/pages/tags/influxdb.html CVE Daily – InfluxDB (High+Critical) en Wed, 03 Jun 2026 21:27:00 +0000 [High] CVE-2026-25751 – FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An inf... https://nvd.nist.gov/vuln/detail/CVE-2026-25751 https://nvd.nist.gov/vuln/detail/CVE-2026-25751 Fri, 06 Feb 2026 19:16:10 +0000 High CVE-2026-25751

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of…

CVSS: 7.5 · CWE: CWE-306

View on NVD

]]> [Critical] CVE-2024-30896 – InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under t... https://nvd.nist.gov/vuln/detail/CVE-2024-30896 https://nvd.nist.gov/vuln/detail/CVE-2024-30896 Thu, 21 Nov 2024 11:15:34 +0000 Critical CVE-2024-30896

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators…

CVSS: 9.1 · CWE: CWE-922

View on NVD

]]> [Critical] CVE-2022-36640 – influxData influxDB before v1.8.10 contains no authentication mechanism or contr... https://nvd.nist.gov/vuln/detail/CVE-2022-36640 https://nvd.nist.gov/vuln/detail/CVE-2022-36640 Fri, 02 Sep 2022 21:15:16 +0000 Critical CVE-2022-36640

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to an…

CVSS: 9.8 · CWE: CWE-276

View on NVD

]]> [Critical] CVE-2019-20933 – InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenti... https://nvd.nist.gov/vuln/detail/CVE-2019-20933 https://nvd.nist.gov/vuln/detail/CVE-2019-20933 Thu, 19 Nov 2020 02:15:11 +0000 Critical CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

CVSS: 9.8 · CWE: CWE-287

View on NVD

]]> [High] CVE-2019-10329 – Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its g... https://nvd.nist.gov/vuln/detail/CVE-2019-10329 https://nvd.nist.gov/vuln/detail/CVE-2019-10329 Fri, 31 May 2019 15:29:00 +0000 High CVE-2019-10329

Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

CVSS: 8.8 · CWE: CWE-522

View on NVD

]]>