Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade k3s | Aug 22, 2024 | Jul 3, 2023 |
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Jul 3, 2023 |
| Kubernetes | — | Upgrade Kubernetes to version 1.24.15Upgrade Kubernetes to version 1.27.3Upgrade Kubernetes to version 1.25.11Upgrade Kubernetes to version 1.26.6 | Jul 14, 2023 | Jul 3, 2023 |
| Oracle_linux | — | Upgrade yqUpgrade olcne-calico-chartUpgrade olcne-nginxUpgrade olcne-prometheus-chartUpgrade olcne-kubevirt-chartUpgrade olcne-rook-chartUpgrade olcnectlUpgrade olcne-extra-modulesUpgrade olcne-grafana-chartUpgrade olcne-istio-chartUpgrade olcne-oci-ccm-chartUpgrade olcne-utilsUpgrade olcne-multus-chartUpgrade olcne-api-serverUpgrade kubeadmUpgrade kubeletUpgrade olcne-olm-chartUpgrade kubectlUpgrade olcne-metallb-chartUpgrade olcne-gluster-chartUpgrade olcne-agent | May 21, 2024 | Jul 3, 2023 |
| Redhat Openshift | — | Upgrade openshiftUpgrade python-oslo-versionedobjectsUpgrade coreos-installerUpgrade python-dracclientUpgrade microshiftUpgrade python-pycadfUpgrade python-wraptUpgrade python-toozUpgrade runcUpgrade python-ironic-libUpgrade python-keystonemiddlewareUpgrade podmanUpgrade python-fixturesUpgrade python-oslo-contextUpgrade openshift4-aws-isoUpgrade skopeoUpgrade python-automatonUpgrade crunUpgrade crun-wasmUpgrade python-futuristUpgrade python-scciclientUpgrade gtestUpgrade python-debtcollectorUpgrade wasmedgeUpgrade python-sushy-oem-idracUpgrade openshift-kuryrUpgrade python-ironic-prometheus-exporterUpgrade python-oslo-logUpgrade buildahUpgrade python-osprofilerUpgrade openshift-clientsUpgrade python-cinderclientUpgrade python-oslo-concurrencyUpgrade python-oslo-configUpgrade python-oslo-serializationUpgrade python-os-traitsUpgrade containernetworking-pluginsUpgrade openstack-ironic-inspectorUpgrade openstack-ironic-python-agentUpgrade rust-afterburnUpgrade ovn23.09Upgrade python-osc-libUpgrade container-selinuxUpgrade python-swiftclientUpgrade python-oslo-policyUpgrade python-os-service-typesUpgrade python-openstacksdkUpgrade openshift-ansibleUpgrade python-oslo-rootwrapUpgrade spdlogUpgrade containers-commonUpgrade python-glanceclientUpgrade golang-github-prometheus-promuUpgrade python-tenacityUpgrade ignitionUpgrade python-oslo-utilsUpgrade haproxyUpgrade butaneUpgrade python-pbrUpgrade python-oslo-messagingUpgrade python-keystoneauth1Upgrade python-decoratorUpgrade openstack-ironicUpgrade python-proliantutilsUpgrade python-oslo-upgradecheckUpgrade kernelUpgrade toolboxUpgrade python-hardwareUpgrade python-oslo-serviceUpgrade nmstateUpgrade cri-toolsUpgrade python-keystoneclientUpgrade google-benchmarkUpgrade python-stevedoreUpgrade catchUpgrade python-oslo-middlewareUpgrade cri-oUpgrade python-sushyUpgrade python-requestsexceptionsUpgrade python-cliffUpgrade python-oslo-cacheUpgrade python-oslo-i18nUpgrade conmonUpgrade fmtUpgrade kernel-rtUpgrade python-oslo-dbUpgrade kata-containers | Nov 1, 2023 | Jun 15, 2023 |
| Suse | — | Upgrade kubernetes1.24-proxyUpgrade kubernetes1.23-apiserverUpgrade kubernetes1.23-client-commonUpgrade kubernetes1.18-client-commonUpgrade kubernetes1.23-proxyUpgrade kubernetes1.18-clientUpgrade kubernetes1.23-clientUpgrade kubernetes1.23-kubeletUpgrade kubernetes1.24-clientUpgrade kubernetes1.24-kubelet-commonUpgrade kubernetes1.23-client-bash-completionUpgrade kubernetes1.24-client-bash-completionUpgrade kubernetes1.23-kubelet-commonUpgrade kubernetes1.23-kubeadmUpgrade kubernetes1.24-client-fish-completionUpgrade kubernetes1.24-apiserverUpgrade kubernetes1.24-client-commonUpgrade kubernetes1.24-kubeletUpgrade kubernetes1.23-controller-managerUpgrade kubernetes1.24-kubeadmUpgrade kubernetes1.24-controller-managerUpgrade kubernetes1.24-schedulerUpgrade kubernetes1.23-client-fish-completionUpgrade kubernetes1.23-scheduler | Jun 20, 2023 | Jun 19, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub