InfluxDB OSS versions 2.x through 2.7.11 store the administrative operator token under the default organization, allowing users with read access to the authorization resource of that organization to retrieve the operator token. This vulnerability enables privilege escalation by exposing a highly sensitive token. The vendor acknowledges this as intended behavior related to the organizations feature and recommends adding users to non-default organizations to mitigate risk. The vulnerability is fixed in InfluxDB 2.8.0, which removes the ability to retrieve tokens from the API.

An attacker or authorized user with read access to the authorization resource of the default organization can obtain the administrative operator token, potentially leading to full administrative control over the InfluxDB instance. This can result in complete compromise of confidentiality, integrity, and availability of the database. The CVSS score of 9.1 reflects the critical nature of this vulnerability with network attack vector, low attack complexity, and high privileges required.

Upgrade to InfluxDB version 2.8.0 or later, where this vulnerability is addressed by removing the ability to retrieve tokens from the API. Until upgrading, limit read access to the authorization resource of the default organization and consider assigning users to non-default organizations as recommended by the vendor. Monitor vendor advisories for any additional guidance.