Medium severity5.4NVD Advisory· Published Aug 29, 2022· Updated Jun 17, 2026
CVE-2022-31677
CVE-2022-31677
Description
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
go.pinniped.devGo | >= 0.3.0, < 0.19.0 | 0.19.0 |
Affected products
4- Pinniped Supervisor/Pinniped Supervisordescription
- osv-coords2 versions
>= 0.3.0, < 0.19.0+ 1 more
- (no CPE)range: >= 0.3.0, < 0.19.0
- (no CPE)range: >= 0.3.0, < 0.19.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-rp4v-hhm6-rcv9ghsaADVISORY
- github.com/vmware-tanzu/pinniped/security/advisories/GHSA-rp4v-hhm6-rcv9nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-31677ghsaADVISORY
- github.com/vmware-tanzu/pinniped/pull/1264ghsaWEB
- github.com/vmware-tanzu/pinniped/releases/tag/v0.19.0ghsaWEB
News mentions
0No linked articles in our index yet.