CVE-2022-46146

Medium

Advisory

Published 29 Nov 2022In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.2; base score, highest
EPSS: 0.012; 66th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 56; of 17,781 indexed, latest versions
Container images: 51; deployed by those charts
Fix available: 1 of 1; affected package

Prometheus Exporter-Toolkit is vulnerable to authentication bypass

Carried by container images the latest versions of 56 of 17,781 indexed charts deploy, on 51 images.

Affected package	Affected versions	Fixed in	Images
github.com/prometheus/exporter-toolkitgolang	v0.5.1, v0.6.0, v0.6.1, v0.7.0+3 more	0.7.2, 0.8.2	51

OSV records: GHSA-7rg2-cxvp-9p7p
Also known as: GO-2022-1130

Charts affected

56 by stars

Chart

Latest

Affected images

Radar Score

loki-simple-scalablegrafana

1.8.11

2 of 3 See more

loki-simple-scalable grafana 1.8.11

2 of the 3 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/agent-operator :v0.25.1	a136c6208aa3	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
grafana/loki :2.6.1	1ee60f980950	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

6,470

devtron-operatordevtron

0.23.3

1 of 11 See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
quay.io/devtron/postgres_exporter :v0.10.1	3ea136843b2e	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

32,902

temporallemontech

0.37.0

3 of 13 See more

temporal lemontech 0.37.0

3 of the 13 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
prom/pushgateway :v1.4.2	a684e7c830a4	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2
quay.io/prometheus/alertmanager :v0.23.0	9ab73a421b65	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2
quay.io/prometheus/prometheus :v2.31.1	a8779cfe553e	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2

Open the chart page →

14,893

aperture-controlleraperture

2.34.0

1 of 5 See more

aperture-controller aperture 2.34.0

1 of the 5 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.33.5	91100b06e86d	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

4,663

prometheusavesha

19.3.0

1 of 4 See more

prometheus avesha 19.3.0

1 of the 4 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.7.0	a15ca437f230	github.com/prometheus/exporter-toolkit@v0.8.1	0.8.2

Open the chart page →

5,484

stash-enterpriseappscode

0.42.0

1 of 4 See more

stash-enterprise appscode 0.42.0

1 of the 4 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
prom/pushgateway :v1.4.2	a684e7c830a4	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2

Open the chart page →

3,620

cnpg-sandboxcloudnative-pg

0.6.1

1 of 6 See more

cnpg-sandbox cloudnative-pg 0.6.1

1 of the 6 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :8.3.5	cd7cb4345aa7	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2

Open the chart page →

7,583

carettagroundcover

0.0.16

1 of 3 See more

caretta groundcover 0.0.16

1 of the 3 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

6,799

hawkhawk

1.1.5

1 of 4 See more

hawk hawk 1.1.5

1 of the 4 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :8.5.0	42d3e6bc1865	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2

Open the chart page →

13,610

kube-state-metricskubestar-state-metrics

0.1.10

1 of 1 See more

kube-state-metrics kubestar-state-metrics 0.1.10

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.6.0	bdab4e49d71d	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

1,575

voice-biometricslumenvox

2.0.1

2 of 26 See more

voice-biometrics lumenvox 2.0.1

2 of the 26 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
quay.io/prometheus/node-exporter :v1.1.2	22fbde17ab64	github.com/prometheus/exporter-toolkit@v0.5.1	0.7.2
quay.io/prometheus/prometheus :v2.26.0	38d40a760569	github.com/prometheus/exporter-toolkit@v0.5.1	0.7.2

Open the chart page →

70,741

grafanaromanow-helm-charts

1.7.1

1 of 1 See more

grafana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :8.3.4	cf81d2c753c8	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2

Open the chart page →

2,835

kubedb-oneappscode

2023.12.28

1 of 10 See more

kubedb-one appscode 2023.12.28

1 of the 10 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
prom/pushgateway :v1.4.2	a684e7c830a4	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2

Open the chart page →

15,200

stash-communityappscode

0.42.0

1 of 4 See more

stash-community appscode 0.42.0

1 of the 4 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
prom/pushgateway :v1.4.2	a684e7c830a4	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2

Open the chart page →

3,661

itera-lmaarzu

1.34.60

3 of 6 See more

itera-lma arzu 1.34.60

3 of the 6 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :9.0.1	a738d0744784	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2
quay.io/prometheus/node-exporter :v1.3.1	f2269e73124d	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.5.0	09a36e2be1db	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

8,608

performanceandusagediagnosisassist-iot-pud

1.0.0

3 of 7 See more

performanceandusagediagnosis assist-iot-pud 1.0.0

3 of the 7 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :9.1.1	9746858c20e6	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2
quay.io/prometheus/prometheus :v2.36.2	df0cd5887887	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.6.0	bdab4e49d71d	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

8,556

prometheusazureorkestra

14.8.0

2 of 6 See more

prometheus azureorkestra 14.8.0

2 of the 6 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
quay.io/prometheus/node-exporter :v1.1.2	22fbde17ab64	github.com/prometheus/exporter-toolkit@v0.5.1	0.7.2
quay.io/prometheus/prometheus :v2.26.0	38d40a760569	github.com/prometheus/exporter-toolkit@v0.5.1	0.7.2

Open the chart page →

9,661

cortex-gatewaydeliveryhero

0.1.9

1 of 1 See more

cortex-gateway deliveryhero 0.1.9

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
goelankit/cortex-gateway :v1.1.0	0d9a82dcf026	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

2,234

devtron-enterprisedevtron

48.0.0

1 of 28 See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
quay.io/devtron/postgres_exporter :v0.10.1	3ea136843b2e	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

68,240

kube-prometheus-stackdevtron

19.3.0

2 of 6 See more

kube-prometheus-stack devtron 19.3.0

2 of the 6 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :8.2.5	00568d89c4f8	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2
quay.io/prometheus/node-exporter :v1.2.2	a990408ed288	github.com/prometheus/exporter-toolkit@v0.6.0	0.7.2

Open the chart page →

8,645

devtron-enterprisedevtron-labs

48.0.0

1 of 28 See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
quay.io/devtron/postgres_exporter :v0.10.1	3ea136843b2e	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

68,240

devtron-operatordevtron-labs

0.23.3

1 of 11 See more

devtron-operator devtron-labs 0.23.3

1 of the 11 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
quay.io/devtron/postgres_exporter :v0.10.1	3ea136843b2e	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

32,902

kube-prometheus-stackdevtron-labs

19.3.0

2 of 6 See more

kube-prometheus-stack devtron-labs 19.3.0

2 of the 6 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :8.2.5	00568d89c4f8	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2
quay.io/prometheus/node-exporter :v1.2.2	a990408ed288	github.com/prometheus/exporter-toolkit@v0.6.0	0.7.2

Open the chart page →

8,645

snmp-exporterdniel

0.0.2

1 of 1 See more

snmp-exporter dniel 0.0.2

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
prom/snmp-exporter :v0.20.0	9d226d7de223	github.com/prometheus/exporter-toolkit@v0.5.1	0.7.2

Open the chart page →

2,126

prometheus-memcached-exporterdouban

0.1.3

1 of 1 See more

prometheus-memcached-exporter douban 0.1.3

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
prom/memcached-exporter :v0.9.0	01267317c95d	github.com/prometheus/exporter-toolkit@v0.5.1	0.7.2

Open the chart page →

2,114

tencentcloud-info-exporterdouban

0.2.2

1 of 1 See more

tencentcloud-info-exporter douban 0.2.2

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
ghcr.io/leoquote/tencentcloud-info-exporter :main	d523c2c010cd	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

2,325

drogue-cloud-examplesdrogue-iot

0.7.11

1 of 6 See more

drogue-cloud-examples drogue-iot 0.7.11

1 of the 6 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :9.2.4	057896e23443	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

30,699

drogue-cloud-metricsdrogue-iot

0.7.11

3 of 8 See more

drogue-cloud-metrics drogue-iot 0.7.11

3 of the 8 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :9.2.4	057896e23443	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
quay.io/prometheus/node-exporter :v1.1.2	22fbde17ab64	github.com/prometheus/exporter-toolkit@v0.5.1	0.7.2
quay.io/prometheus/prometheus :v2.26.0	38d40a760569	github.com/prometheus/exporter-toolkit@v0.5.1	0.7.2

Open the chart page →

13,558

temporaldtrdnk-helm-charts

0.35.0

3 of 13 See more

temporal dtrdnk-helm-charts 0.35.0

3 of the 13 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
prom/pushgateway :v1.4.2	a684e7c830a4	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2
quay.io/prometheus/alertmanager :v0.23.0	9ab73a421b65	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2
quay.io/prometheus/prometheus :v2.31.1	a8779cfe553e	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2

Open the chart page →

20,205

faasnetfaasnet

0.0.4

1 of 5 See more

faasnet faasnet 0.0.4

1 of the 5 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
simpleidserver/faasprometheus :0.0.4	25e378d57d78	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2

Open the chart page →

7,617

maxscalefour-allportal

4.1.16

1 of 3 See more

maxscale four-allportal 4.1.16

1 of the 3 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
bitnamilegacy/mysqld-exporter :0.14.0-debian-11-r103	04768b637c94	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

6,611

Governify-Bluejaygovernify

0.1.0

1 of 12 See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2

Open the chart page →

22,512

Governify-Falcongovernify

0.1.0

1 of 10 See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2

Open the chart page →

24,319

mimir-openshift-experimentalgrafana

2.1.0

1 of 4 See more

mimir-openshift-experimental grafana 2.1.0

1 of the 4 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/mimir :2.0.0	80c1a8eb24dd	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

17,759

loki-proxygroundcover

0.1.1

1 of 1 See more

loki-proxy groundcover 0.1.1

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/loki-proxy :0.1.1	783d550ad813	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

2,175

logging-stackhelm-charts-alexis-carbillet

0.1.0

3 of 9 See more

logging-stack helm-charts-alexis-carbillet 0.1.0

3 of the 9 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/agent-operator :v0.25.1	a136c6208aa3	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
grafana/loki :2.6.1	1ee60f980950	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
grafana/loki-canary :2.6.1	ab2a2569307b	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

12,650

cortex-gatewayhelm-charts-nr

0.1.9

1 of 1 See more

cortex-gateway helm-charts-nr 0.1.9

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
goelankit/cortex-gateway :v1.1.0	0d9a82dcf026	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

2,234

multimodal-data-visualizationintel

3.0.0

1 of 2 See more

multimodal-data-visualization intel 3.0.0

1 of the 2 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
intel/multimodal-data-visualization :3.0	3426deb77337	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2

Open the chart page →

11,069

kiaekiae

0.1.6

3 of 9 See more

kiae kiae 0.1.6

3 of the 9 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/loki :2.6.1	1ee60f980950	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
grafana/promtail :2.6.1	072527b12cdf	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
otel/opentelemetry-collector-contrib :0.63.1	dfb3a55ea8c9	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

19,168

nvidia-gpu-exporterkubeblocks

0.3.1

1 of 1 See more

nvidia-gpu-exporter kubeblocks 0.3.1

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
utkuozdemir/nvidia_gpu_exporter :0.3.0	149f9e7e7aa3	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2

Open the chart page →

4,462

prometheuskubeblocks

15.16.1

5 of 6 See more

prometheus kubeblocks 15.16.1

5 of the 6 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
prom/pushgateway :v1.4.3	3496e0f85943	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
quay.io/prometheus/alertmanager :v0.24.0	088464f949de	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
quay.io/prometheus/node-exporter :v1.3.1	f2269e73124d	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2
quay.io/prometheus/prometheus :v2.39.1	4748e26f9369	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.5.0	09a36e2be1db	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

10,302

prometheuslectures-k8sinfra

15.8.5

4 of 6 See more

prometheus lectures-k8sinfra 15.8.5

4 of the 6 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
prom/pushgateway :v1.4.2	a684e7c830a4	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2
quay.io/prometheus/alertmanager :v0.23.0	9ab73a421b65	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2
quay.io/prometheus/node-exporter :v1.3.0	23ff46c728b9	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2
quay.io/prometheus/prometheus :v2.37.0	56e7f18e05dd	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

9,092

backendmojaloop

0.1.0

1 of 6 See more

backend mojaloop 0.1.0

1 of the 6 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
bitnamilegacy/mysqld-exporter :0.13.0	a7e14cc919cb	github.com/prometheus/exporter-toolkit@v0.5.1	0.7.2

Open the chart page →

16,198

one-green-coreone-green-core

0.0.7

1 of 8 See more

one-green-core one-green-core 0.0.7

1 of the 8 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/grafana :8.5.3	ecc1b80b8ca2	github.com/prometheus/exporter-toolkit@v0.7.0	0.7.2

Open the chart page →

9,558

kruise-state-metricsopenkruise

0.2.0

1 of 1 See more

kruise-state-metrics openkruise 0.2.0

1 of the 1 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
openkruise/kruise-state-metrics :v0.2.0	a8108f771287	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2

Open the chart page →

1,928

opscruiseopenshift

0.35.100

1 of 11 See more

opscruise openshift 0.35.100

1 of the 11 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.36.2	df0cd5887887	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2

Open the chart page →

8,201

loki-stackphntom

2.10.2

1 of 2 See more

loki-stack phntom 2.10.2

1 of the 2 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/loki :2.4.2	b3af8ead67d7	github.com/prometheus/exporter-toolkit@v0.6.1	0.7.2

Open the chart page →

5,708

npre-essentialsphntom

0.1.60

4 of 22 See more

npre-essentials phntom 0.1.60

4 of the 22 container images this version deploys carry CVE-2022-46146.

Container image	Digest	Package	Fixed in
grafana/loki :2.6.1	1ee60f980950	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
grafana/promtail :2.7.0	c16c710f7333	github.com/prometheus/exporter-toolkit@v0.7.2-0.20220901134540-2434b08435da	0.7.2
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	github.com/prometheus/exporter-toolkit@v0.7.1	0.7.2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.7.0	a15ca437f230	github.com/prometheus/exporter-toolkit@v0.8.1	0.8.2