CVE-2022-24797: Exposure of Sensitive Information in Pomerium
Summary
CVE-2022-24797: Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium. Affects github.com/pomerium/pomerium versions >= 0.16.0, < 0.17.1. Fixed in 0.17.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pomerium is a Go package that provides secure access to internal applications and services. It acts as a reverse proxy and authentication middleware, allowing users to authenticate and access applications securely. The package is widely used in various Go projects to enforce access control policies and protect sensitive information.
Vulnerability Detail
This vulnerability in Pomerium allows for the exposure of sensitive information. Attackers can exploit this issue to gain unauthorized access to sensitive data, such as user credentials or confidential application data. The vulnerability arises from a flaw in the package's implementation, which fails to properly handle certain requests, leading to the disclosure of sensitive information. This can have severe consequences, including unauthorized access, data breaches, and potential compromise of user accounts or sensitive systems.
How To Fix
Latest published version: v0.33.4 as of 22 Oct 2026
go get github.com/pomerium/pomerium@v0.33.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.17.1
This is the first release that contains the fix.
go get github.com/pomerium/pomerium@v0.17.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality or restrict access to the vulnerable component. However, this may impact the functionality and usability of the application. It is strongly advised to apply the official fix by upgrading to the latest version of the Pomerium package.
Conclusion
The exposure of sensitive information vulnerability in Pomerium poses a significant risk to applications and systems utilizing the affected package versions. It is crucial to promptly update to version 0.17.1 or later to mitigate the risk of unauthorized access and data breaches. Applying the official fix will ensure the confidentiality and integrity of sensitive information.
See every vulnerability recorded for github.com/pomerium/pomerium →
FAQ
This vulnerability can lead to the exposure of sensitive information, potentially resulting in unauthorized access, data breaches, and compromise of user accounts or sensitive systems.
Any application or system that utilizes the Pomerium package version 0.16.0 to 0.17.0 is affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the fix promptly to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely by attackers who can send specially crafted requests to the affected component.
No, a CVSS score has not been assigned to this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pomerium/pomerium.
