Every CVE Search/ Get API key

CVE-2024-10220

Arbitrary command execution through gitRepo volume

8.1 HighPublic exploitFix available

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

3.03%Up 3.0 points since Nov 23, 2024
90%50%10%1%

What each source reports

CVE List Score used 8.1

Arbitrary command execution through gitRepo volume

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
CVE-2024-10220
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2024-3336 8.1

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
EUVD-2024-3336
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-27wf-5967-98gx 8.6

Kubernetes kubelet arbitrary command execution

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
GHSA-27wf-5967-98gx
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 8.1

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
CVE-2024-10220
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 8.1

Arbitrary command execution through gitRepo volume

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
CVE-2024-10220
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVDEBIAN-CVE-2024-10220 8.1

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
DEBIAN-CVE-2024-10220
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-27wf-5967-98gx 8.6

Kubernetes kubelet arbitrary command execution

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
GHSA-27wf-5967-98gx
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVOESA-2024-2532 8.1

kubernetes security update

Container cluster management.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in Kubernetes up to 1.28.11/1.29.6/1.30.2 (Virtualization Software). Affected is an unknown code block of the component gitRepo Volume Handler. Upgrading to version 1.28.12, 1.29.7, 1.30.3 or 1.31.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2024-10220)

Record
OESA-2024-2532
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-10220 8.1

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
UBUNTU-CVE-2024-10220
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVAZL-53528 No score

CVE-2024-10220 affecting package kubernetes for versions less than 1.30.3-1

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
AZL-53528
Updated
2026-11-02
OSVAZL-53652 No score

CVE-2024-10220 affecting package kubernetes for versions less than 1.28.4-14

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Record
AZL-53652
Updated
2026-11-02
OSVGO-2024-3286 No score

Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes

Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes

Record
GO-2024-3286
Updated
2026-11-02
OSVMGASA-2024-0389 No score

Updated kubernetes packages fix security vulnerabilities

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated. CVE-2024-3177 The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes. CVE-2024-10220

Record
MGASA-2024-0389
Updated
2026-11-02
OSVopenSUSE-SU-2024:14567-1 No score

govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14567-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
k8s.io/kubernetes
Go
 before 1.28.12
1.28.12
k8s.io/kubernetes
Go
 1.29.0 up to 1.29.7
1.29.7
k8s.io/kubernetes
Go
 1.30.0 up to 1.30.3
1.30.3
kubernetes
Azure Linux:3
 before 1.30.3-1
1.30.3-1
kubernetes
Azure Linux:2
 before 1.28.4-14
1.28.4-14
kubernetes
Debian:12
 before 1.20.5+really1.20.2-1
1.20.5+really1.20.2-1
kubernetes
Debian:13
 before 1.20.5+really1.20.2-1
1.20.5+really1.20.2-1
kubernetes
Debian:14
 before 1.20.5+really1.20.2-1
1.20.5+really1.20.2-1
k8s.io/kubernetes
Go
 before 1.28.12, 1.29.0 up to 1.29.7, 1.30.0 up to 1.30.3
1.28.121.29.71.30.3
kubernetes
Mageia:9
From an advisory covering 2 CVEs
 before 1.27.16-2.mga9
1.27.16-2.mga9
Show 6 moreShow less
Affected packages
PackageAffectedFixed
kubernetes
openEuler:22.03-LTS-SP4
 before 1.20.2-26.oe2203sp4
1.20.2-26.oe2203sp4
kubernetes
openEuler:22.03-LTS-SP3
 before 1.20.2-26.oe2203sp3
1.20.2-26.oe2203sp3
kubernetes
openEuler:20.03-LTS-SP4
 before 1.20.2-26.oe2003sp4
1.20.2-26.oe2003sp4
kubernetes
openEuler:22.03-LTS-SP1
 before 1.20.2-26.oe2203sp1
1.20.2-26.oe2203sp1
kubernetes
openEuler:24.03-LTS
 before 1.29.1-9.oe2403
1.29.1-9.oe2403
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 0.0.20241209T183251-1.1
0.0.20241209T183251-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmochizuki875/CVE-2024-10220-githooks2024-11-21
PoC in GitHubany2sec/cve-2024-102202024-11-29
PoC in GitHubfilipzag/CVE-2024-102202024-12-15
PoC in GitHubcandranapits/poc-CVE-2024-102202024-12-17
PoC in GitHuborgC/CVE-2024-10220-demo2025-05-12
PoC in GitHubmrk336/CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability2025-09-08
PoC in GitHubsaleha-muzammil/cve-2024-10220-git-on-git2025-11-23
PoC in GitHubimohammed28/cve-2024-10220-test2025-11-30

History

History
RecordedChangedSources
affected, exploits, facts
affected
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-10220 is a high vulnerability (CVSS 8.1) in Kubernetes Kubelet, published November 22, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.03%, the 87th percentile. Fixed in k8s.io/kubernetes 1.28.12.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open