CVE-2024-1725
Kubevirt-csi: persistentvolume allows access to hcp's root node
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Kubevirt-csi: persistentvolume allows access to hcp's root node
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
- Record
CVE-2024-1725- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-501
- Updated
- 2026-11-02
EUVDEUVD-2024-17457
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
- Record
EUVD-2024-17457- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fg9q-5cw2-p6r9
kubevirt-csi: PersistentVolume allows access to HCP's root node
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
- Record
GHSA-fg9q-5cw2-p6r9- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-501
- Updated
- 2026-11-02
NVD
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
- Record
CVE-2024-1725- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-501
- Updated
- 2026-11-02
OSVGHSA-fg9q-5cw2-p6r9
kubevirt-csi: PersistentVolume allows access to HCP's root node
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
- Record
GHSA-fg9q-5cw2-p6r9- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-501
- Updated
- 2026-11-02
OSVGO-2025-3512 No score
kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver
kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/kubevirt/csi-driver before v0.0.0-202403081943-cc28dcbb0afc14.
- Record
GO-2025-3512- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14893-1 No score
govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250313T170021-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14893-1- Updated
- 2026-11-02
Affected products
- red hat openshift container platform 4.13
- red hat openshift container platform 4.14
- red hat openshift container platform 4.15
- redhat openshift container platform
- redhat openshift container platform for arm64
- redhat openshift container platform for ibm z
- redhat openshift container platform for linuxone
- redhat openshift container platform for power
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/kubevirt/csi-driverGo |
before 0.0.0-202403081943-cc28dcbb0afc14 | 0.0.0-202403081943-cc28dcbb0afc14 |
github.com/kubevirt/csi-driverGo |
All versions | None known |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 0.0.20250313T170021-1.1 | 0.0.20250313T170021-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-1725 is a medium vulnerability (CVSS 6.5) in Red Hat Openshift Container Platform 4.13, published March 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in github.com/kubevirt/csi-driver 0.0.0-202403081943-cc28dcbb0afc14.
References
access.redhat.com/errata/RHSA-2024:1559
bugzilla.redhat.com/show_bug.cgi?id=2265398
nvd.nist.gov/vuln/detail/CVE-2024-1725
Show 11 moreShow less
github.com/kubevirt/csi-driver/commit/cc28dcbb0afca0a7cb8a73bc998ab49f864ed560
pkg.go.dev/vuln/GO-2025-3512
lists.opensuse.org/archives/list/[email protected]/thread/IISU33DXNWHOYGRCT77IPABZTMARV5T6
suse.com/security/cve/CVE-2024-1725