CVE-2022-36640
Critical · CVSS 9.8influxData influxDB — Missing authentication / unauthenticated remote command execution (CWE-276 incorrect default permissions)
- CVSS
- 9.8
- nvd
- EPSS
- 2.05%
- 79th pct
- KEV
- No
- Class
- oss containerizable
- CWE-276
Description
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization."
Search profile — drives PoC discovery
Ranked PoCs (1) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0cyb3r-w0lf/nuclei-template-collection needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
Affected packages
| Bitnami | influxdb | 0 → 1.8.0 |
References
- http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx
- https://dl.influxdata.com/influxdb/releases/influxdb_1.8.10_amd64.deb
- https://portal.influxdata.com/downloads/
- https://www.influxdata.com/
- http://influxdata.com
- http://influxdb.com
- http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx
- https://dl.influxdata.com/influxdb/releases/influxdb_1.8.10_amd64.deb
- https://portal.influxdata.com/downloads/
- https://www.influxdata.com/
Status: enriched · ingested 2026-07-05T18:00:39.000Z · profiled 2026-07-05T18:30:39.000Z