A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
CVSS Details
- CVSS 3.1 Base Score: 2.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Apr 22, 2024 |
| Redhat Openshift | — | Upgrade openshiftUpgrade microshift | Jun 28, 2024 | Apr 16, 2024 |
| Suse | — | Upgrade kubernetes1.24-controller-managerUpgrade kubernetes1.24-proxyUpgrade kubernetes1.23-clientUpgrade kubernetes1.23-schedulerUpgrade kubernetes1.24-client-commonUpgrade kubernetes1.23-kubeadmUpgrade kubernetes1.24-kubeletUpgrade kubernetes1.24-apiserverUpgrade kubernetes1.23-kubelet-commonUpgrade kubernetes1.23-kubeletUpgrade kubernetes1.24-clientUpgrade kubernetes1.23-client-fish-completionUpgrade kubernetes1.23-proxyUpgrade kubernetes1.24-client-fish-completionUpgrade kubernetes1.24-client-bash-completionUpgrade kubernetes1.23-client-bash-completionUpgrade kubernetes1.23-apiserverUpgrade kubernetes1.24-schedulerUpgrade kubernetes1.23-client-commonUpgrade kubernetes1.24-kubelet-commonUpgrade kubernetes1.24-kubeadmUpgrade kubernetes1.23-controller-manager | Apr 24, 2024 | Apr 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub