External risk intelligence

InfluxDB Unauthenticated Command Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-36640

InfluxDB is commonly deployed as a database service with network-accessible endpoints. While the vendor documentation advises enabling authentication, the default configuration lacks it, making the service, when exposed, a network-reachable management or data interface that is commonly accessible in many infrastructure deployments.

Influxdata Influxdb

before 1.8.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability concerns a widely used time-series database that, in certain configurations, lacks authentication, potentially allowing unauthorized access to data and command execution. The primary concern is to confirm if this database is deployed in a way that exposes it to the internet without proper security controls.

Unauthenticated access to database and commands.
Matters if database is exposed externally.
Confirm relevance and exposure to leadership.

Attack Path

How an attacker could exploit the issue

Attackers can reach and trigger this vulnerability when InfluxDB is deployed without authentication. The lack of authentication allows unauthenticated attackers to execute arbitrary commands on the affected system.

No authentication required.
Unauthenticated network access.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

When deployed without authentication on a publicly accessible endpoint, this vulnerability could allow unauthenticated attackers to execute arbitrary commands on the system. This could affect sensitive information stored within the InfluxDB database and impact the normal operation of the service.

Database data and system integrity at risk.
Remote code execution via unauthenticated access.
Service disruption and data compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects InfluxDB deployments where authentication is not explicitly enabled, allowing unauthenticated access to execute arbitrary commands. The primary responsibility for addressing this lies with the platform or infrastructure teams managing the InfluxDB instances, in coordination with application owners who rely on the database. The first critical step is to identify all InfluxDB deployments, determine their network exposure, and confirm business criticality before planning remediation.

Platform/infrastructure teams own remediation.
Verify network exposure and critical deployments.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is InfluxDB?

InfluxDB is an open-source time-series database designed to store and analyze massive volumes of timestamped data, such as system metrics or sensor readings. It is frequently used by developers and infrastructure teams to power real-time monitoring and analytics dashboards. Because it manages operational data, it often acts as a critical backend service that needs to be properly secured to prevent unauthorized access to the information it tracks.

How does CVE-2022-36640 affect InfluxDB security?

This vulnerability relates to a CWE-276 weakness, which involves improper access control. In affected versions of InfluxDB, the software may operate without an authentication mechanism enabled by default. This absence of security controls means that the database does not verify who is connecting, which can allow an unauthenticated user to interact with the system and execute arbitrary commands.

When can an attacker trigger this vulnerability?

An attacker can trigger this issue when the database is deployed without authentication and is accessible over a network. If the service is configured with authentication enabled, or if it is restricted to local-only connections that block external requests, the specific conditions required for this remote command execution path are not met.

Is my InfluxDB instance at risk?

According to Halo Surface Signal, this is a significant concern because InfluxDB is commonly deployed with network-accessible endpoints. You should prioritize checking instances that are internet-facing, as these are the most reachable. If your database is internal-only, the risk is lower but still requires review to ensure that authentication is actually enabled for all users.

How should I respond to this threat?

The first step is to inventory all running InfluxDB instances to confirm their network exposure. Once identified, your infrastructure team should prioritize enabling authentication as documented by the vendor to secure the service. If you are running an older version, consult the release documentation to verify if updating or changing your configuration settings is the most effective path to establishing necessary access controls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.