CVE-2024-31216: Azure Storage SAS Token Leak in github.com/fluxcd/source-controller
Summary
CVE-2024-31216: source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller. Affects github.com/fluxcd/source-controller versions < 1.2.5. Fixed in 1.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/fluxcd/source-controller, an open-source project written in Go. It is a source controller that enables continuous delivery of source code changes to Kubernetes clusters. It integrates with various source control systems, including Azure Storage. The package allows users to configure and manage source code repositories and trigger deployments based on changes in the repositories.
Vulnerability Detail
The vulnerability in github.com/fluxcd/source-controller involves the leakage of Azure Storage Shared Access Signature (SAS) token into logs. When using Azure Storage as a source control system, the package inadvertently logs the SAS token, which is meant to be kept confidential. This token leakage can lead to unauthorized access to the Azure Storage account and potential data breaches or unauthorized modifications of source code repositories.
How To Fix
Latest published version: v1.9.6 as of 23 Oct 2026
go get github.com/fluxcd/source-controller@v1.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.5
This is the first release that contains the fix.
go get github.com/fluxcd/source-controller@v1.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify the source code of github.com/fluxcd/source-controller to remove the logging of SAS tokens. Specifically, they should locate the code responsible for logging and remove any references to the SAS token. However, this workaround is not recommended as it requires manual code modifications and may introduce other issues or compatibility problems.
Conclusion
The vulnerability in github.com/fluxcd/source-controller, which leaks Azure Storage SAS tokens into logs, can lead to unauthorized access to Azure Storage accounts and potential data breaches or unauthorized modifications of source code repositories. To fix this vulnerability, users should upgrade to version 1.2.5 or later of the package. It is also recommended to use Vulert Playground at https://vulert.com/scanner to check if your application is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/fluxcd/source-controller →
FAQ
The vulnerability allows an attacker to obtain the Azure Storage SAS token, which can lead to unauthorized access to the Azure Storage account and potential data breaches or unauthorized modifications of source code repositories.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for open-source vulnerabilities, including this one.
Yes, a fix is available in version 1.2.5 or later of github.com/fluxcd/source-controller. It is recommended to upgrade to the latest version to address the vulnerability.
While a workaround is possible by manually modifying the source code to remove the logging of SAS tokens, it is not recommended. Upgrading to the fixed version is the recommended approach to ensure comprehensive vulnerability mitigation.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to address the vulnerability promptly to mitigate the risk of potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fluxcd/source-controller.
