CVE-2024-28110 HIGH

CVE-2024-28110: Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

Vendor Cloudevents
Product sdk-go
Weakness CWE-522 · Insufficiently protected credentials
Published March 6, 2024
Last update April 16, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact. Version 2.15.2 patches this issue.

Key dates

02Disclosure timeline

March 6, 2024 CVE published
April 16, 2025 Record updated