Grafana Plugin SDK Includes Build Metadata and Credentials in Binaries

CVE-2024-8986

Summary

The Grafana Plugin SDK has a vulnerability that allows sensitive information to be embedded in compiled binaries during the build process. When developers use repository URIs containing credentials for private dependencies, this information can be inadvertently included in the final product. This exposure poses a significant risk, as attackers could potentially exploit these credentials to gain unauthorized access to repositories or other resources.

References