CVE-2022-24797: Exposure of debug and metrics endpoints in Pomerium
Summary
CVE-2022-24797: Exposure of debug and metrics endpoints in Pomerium. Affects github.com/pomerium/pomerium versions >= 0.16.0, < 0.17.1. Fixed in 0.17.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pomerium is an open-source tool written in Go that provides secure access to internal applications and services. It acts as a reverse proxy, handling authentication and authorization for incoming requests. Pomerium's Authenticate service, in distributed service mode, exposes debug and metrics endpoints to untrusted traffic. These endpoints include pprof debug and prometheus metrics handlers. This vulnerability can lead to the leakage of sensitive environmental information or result in limited denial of service conditions.
Vulnerability Detail
The exposure of debug and metrics endpoints in Pomerium's Authenticate service allows untrusted traffic to access pprof debug and prometheus metrics handlers. This can potentially leak sensitive environmental information, such as internal system details, and may also lead to limited denial of service conditions. An attacker could exploit this vulnerability to gather intelligence about the target system or disrupt its operation.
How To Fix
Latest published version: v0.33.4 as of 22 Oct 2026
go get github.com/pomerium/pomerium@v0.33.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.17.1
This is the first release that contains the fix.
go get github.com/pomerium/pomerium@v0.17.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, a workaround is to block access to the /debug and /metrics paths on the authenticate service. This can be achieved using any Layer 7 (L7) proxy, including Pomerium's own proxy service. By configuring the proxy to deny requests to these paths, the exposure of debug and metrics endpoints can be mitigated.
Conclusion
The exposure of debug and metrics endpoints in Pomerium's Authenticate service poses a moderate security risk. Upgrading to version 0.17.1 or later, or implementing the provided workaround, will help mitigate this vulnerability. It is recommended to stay updated with the latest security advisories and promptly apply patches to ensure the security of Pomerium installations.
See every vulnerability recorded for github.com/pomerium/pomerium →
FAQ
The vulnerability can result in the leakage of potentially sensitive environmental information and may lead to limited denial of service conditions.
Update Pomerium to version 0.17.1 or later, which includes the necessary patches to restrict access to the debug and metrics endpoints.
Yes, you can block access to the /debug and /metrics paths on the authenticate service using a Layer 7 (L7) proxy.
There are no known exploits for this vulnerability at the time of this advisory.
For more information, you can open an issue in the Pomerium GitHub repository or email security@pomerium.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pomerium/pomerium.
