Fides Information Disclosure Vulnerability in Config API Endpoint
Summary
CVE-2023-46125: Fides Information Disclosure Vulnerability in Config API Endpoint. Affects ethyca-fides versions < 2.22.1. Fixed in 2.22.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Fides is a webserver API that allows users to retrieve its configuration using the GET api/v1/config endpoint. It is designed to filter sensitive configuration information before returning it to the user. However, even the filtered data may contain internal and backend infrastructure details, such as settings, server addresses, ports, and database usernames. This information should not be exposed to low-privileged users, as it can be useful for both administrative users and attackers.
Vulnerability Detail
The Fides webserver API has a vulnerability that allows users with roles lower than the owner role (e.g., the viewer role) to retrieve the configuration information using the API. This information includes sensitive details about the internals and backend infrastructure, which should not be accessible to low-privileged users. The impact of this vulnerability is an information disclosure risk, as it exposes valuable information that can aid attackers in planning and executing attacks.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.22.1
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.22.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The recommended solution is to upgrade to the patched version of Fides.
Conclusion
The Fides Information Disclosure Vulnerability in Config API Endpoint allows low-privileged users to access sensitive configuration information. To mitigate this risk, users should upgrade to Fides version 2.22.1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ethyca-fides →
FAQ
The vulnerability allows low-privileged users to access sensitive configuration information, which can aid attackers in planning and executing attacks.
Users of Fides versions prior to 2.22.1 are affected by this vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the patched version is the recommended solution.
To fix this vulnerability, upgrade to Fides version 2.22.1 or later.
For more information, you can refer to the vulnerability details provided by the GitHub Advisory Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
