-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows a critical modification in the UpdateNamespaces function where the error logging was simplified from 'failed to create clients for' with cluster details to a generic message. The original code (cf.log.Error(err, "failed to create clients for", "clusters", cf.clusters.Get())) directly exposed cluster configurations containing credentials in logs when connection errors occurred. This matches the vulnerability description of leaking KubeConfig data via error logging. The patch explicitly removes the sensitive parameter from the log call, confirming this was the vulnerable code path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/weaveworks/weave-gitops | go | <= 0.8.1-rc.5 | 0.8.1-rc.6 |