PatchTheCVECVE-2022-36640: influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated
CVE-2022-36640 is a critical-severity flaw (CVSS 9.8) affecting influxdb. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.6% (top 15%) |
| CISA exploited list | No |
| Weakness | CWE-276 |
| Published | 2022-09-02 |
| Last modified | 2026-07-09 |
Last updated 2026-07-09 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-36640?
influxdb: upgrade to 1.8.0. Exact commands for each OS are on this page.
Is CVE-2022-36640 being exploited?
CVE-2022-36640 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-36640 affect?
CVE-2022-36640 affects influxdb. Severity is critical (CVSS 9.8). influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If Inf
How urgent is CVE-2022-36640?
Priority 61/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2019-20933 CRITICAL 9.8 UPGRADE MITIGATE InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/http
- CVE-2019-10329 HIGH 8.8 UPGRADE Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on th
- CVE-2018-17572 MEDIUM 4.8 UPGRADE InfluxDB 0.9.5 has Reflected XSS in the Write Data module.