CVE-2024-11217mediumCWE-1295

CVE-2024-11217: medium-severity vulnerability in oauth-server-container

Oauth-server-container: oauth-server-container logs client secret in debug level

Published · Updated

Follow this CVE+ Monitor Red Hat OpenShift Container Platform+ Monitor oauth-server-container

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.4%
In short

The OAuth-server application accidentally logs sensitive client secrets to debug logs when debugging is enabled for certain login services. This means anyone with access to debug logs could see credentials needed to impersonate the application.

Technical detail

CWE-1295 (Improper Handling of Insufficient Entropy in TRNG) manifests as credential exposure in debug output. When logLevel is set to Debug or higher for OIDC/GitHub/GitLab/Google IdP configurations, OAuth2 client secrets are written to logs. An attacker with read access to application logs can extract these credentials and abuse them for authentication bypass or token manipulation.

Summary generated and translated by AI from the official description.
A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
oauth-server-containerRed Hat · Red Hat OpenShift Container Platform 4
Related CVEs — oauth-server-container

In the same product, most dangerous first.

CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.5%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.8%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 38.7%CVE-2026-4480CRITICALSamba: samba: remote code execution in printing subsystem via unescaped job descriptionEPSS 28.7%CVE-2025-26465MEDIUMOpenssh: machine-in-the-middle attack if verifyhostkeydns is enabledEPSS 7.7%