If you run InfluxDB OSS for more than one organization, check who can read authorizations in the default organization. An operator token can reach every organization on the instance.
What changed November 5, 2026
CVE-2024-30896. Microsoft’s 15:02 UTC revision adds the Azure Linux 3.0 influxdb RPM 2.7.5-23 to its affected matrix, alongside 2.7.5-22 and earlier listed builds. MSRC’s first revision is dated September 3, 2025. Microsoft rates the new row Critical, CVSS 3.1 9.1, with high privileges required. The row has no fixed Azure Linux RPM.
The CVE record describes InfluxDB OSS 2.x through 2.7.11 and a caller who can already read authorizations in the default organization. That access can expose the operator token, which InfluxData documents as having read/write access across all organizations. The record also notes that InfluxData considers the organization permissions intentional. Check the running service, its installed RPM and default-organization roles. Microsoft’s CVRF separately lists specific older Azure Linux and CBL-Mariner RPMs.
Microsoft’s product row supplies no exploitation assessment, and CISA’s catalog did not list this CVE on November 6. The CVE record references public research. Suggested MSP priority. Review promptly if separate teams or customers share an OSS instance or if integrations have default-organization authorization access.
What to do
- Inventory OSS instances and identify who can read authorizations in the default organization. Check where operator tokens are stored and which integrations use them.
- Remove unnecessary access to default-organization authorizations and use narrowly scoped tokens for integrations. If an operator token may have been retrieved, preserve available access records, validate replacement administrative access, then rotate and revoke the old token. Review changes across every organization on that instance.
- Confirm a supported upgrade or backport for the installed distribution. InfluxData documents token hashing as enabled by default in upstream OSS 2.9.0, with backup and downgrade implications. Verify the upgrade and authorization behavior in staging before treating an upstream change as the fix for an Azure Linux RPM.
- Verify that scoped integrations still work and that an account without the required authorization permissions cannot read token values. Recheck the package and authorization state after rollout.
Official sources
- Microsoft MSRC CVE-2024-30896
- Microsoft CVRF product and remediation matrix
- CVE Program record
- InfluxData token types and permissions
- InfluxData OSS v2 upgrade and token hashing notes
- CISA Known Exploited Vulnerabilities catalog
Last verified November 6, 2026 UTC.