CVE-2024-8996

7.8 highEPSS 0.3%

High (7.8) in grafana agent. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/grafana/agent 0.43.3.

Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-428
Published: 2024-09-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

grafana:agent

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-m5gv-m5f9-wgv4	Go	github.com/grafana/agent	<0.43.3	0.43.3
GO-2024-3170	Go	github.com/grafana/agent	<0.43.3	0.43.3

References

https://github.com/grafana/agent/releases/tag/v0.43.3
https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996/
https://grafana.com/security/security-advisories/cve-2024-8996/

Check your stack JSON