Advisories for Golang/Github.com/Grafana/Synthetic-Monitoring-Agent/Cmd/Synthetic-Monitoring-Agent package

2024

Default installation of `synthetic-monitoring-agent` exposes sensitive information

Users running the Synthetic Monitoring agent in their local network are impacted. The authentication token used to communicate with the Synthetic Monitoring API is exposed thru a debugging endpoint. This token can be used to retrieve the Synthetic Monitoring checks created by the user and assigned to the agent identified with that token. The Synthetic Monitoring API will reject connections from already-connected agents, so access to the token does not …