CVE-2022-24797

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

• CWE-200

• https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903Patch, Third Party Advisory
• https://github.com/pomerium/pomerium/pull/3212Issue Tracking, Patch, Third Party Advisory
• https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjrMitigation, Third Party Advisory
• https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903Patch, Third Party Advisory
• https://github.com/pomerium/pomerium/pull/3212Issue Tracking, Patch, Third Party Advisory
• https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjrMitigation, Third Party Advisory

Published

Mar 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24791Wasmtime is a standalone JIT-style runtime for WebAssembly, …9.8
• CVE-2022-24792PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24793PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24794Express OpenID Connect is an Express JS middleware implement…6.1
• CVE-2022-24795yajl-ruby is a C binding to the YAJL JSON parsing and genera…7.5
• CVE-2022-24796RaspberryMatic is a free and open-source operating system fo…9.8
• CVE-2022-24798Internet Routing Registry daemon version 4 is an IRR databas…7.5
• CVE-2022-24799wire-webapp is the web application interface for the wire me…6.1
• CVE-2022-2480Use after free in Service Worker API in Google Chrome prior …8.8
• CVE-2022-24800October/System is the system module for October CMS, a self-…8.1
• CVE-2022-24801Twisted is an event-based framework for internet application…8.1
• CVE-2022-24802deepmerge-ts is a typescript library providing functionality…9.8