CVE-2022-3474: Google Bazel

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

Affected products

• Google Bazel: from 3.1.0, before 4.2.3 (fixed in 4.2.3); from 5.0.0, before 5.3.2 (fixed in 5.3.2)

Published 2022-10-26. Last modified 2026-06-17.