CVE-2024-3177
Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
CVE-2024-3177- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2024-1273
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
EUVD-2024-1273- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pxhw-596r-rwq5
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
GHSA-pxhw-596r-rwq5- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
CVE-2024-3177- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
CVE-2024-3177- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-3177
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
DEBIAN-CVE-2024-3177- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 20 moreShow less
OSVGHSA-pxhw-596r-rwq5
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
GHSA-pxhw-596r-rwq5- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVOESA-2024-1550
kubernetes security update
Container cluster management.
Security Fix(es):
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
(CVE-2024-3177)
- Record
OESA-2024-1550- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-1576
kubernetes security update
Container cluster management.
Security Fix(es):
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
(CVE-2024-3177)
- Record
OESA-2024-1576- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-1577
kubernetes security update
Container cluster management.
Security Fix(es):
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
(CVE-2024-3177)
- Record
OESA-2024-1577- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-1579
kubernetes security update
Container cluster management.
Security Fix(es):
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
(CVE-2024-3177)
- Record
OESA-2024-1579- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-1580
kubernetes security update
Container cluster management.
Security Fix(es):
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
(CVE-2024-3177)
- Record
OESA-2024-1580- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-1626
kubernetes security update
Container cluster management.
Security Fix(es):
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
(CVE-2024-3177)
- Record
OESA-2024-1626- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2024:0043
Red Hat Security Advisory: Red Hat build of MicroShift 4.16.0 security update
- Record
RHSA-2024:0043- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:2054
Red Hat Security Advisory: OpenShift Container Platform 4.14.23 security update
- Record
RHSA-2024:2054- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-3177
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
UBUNTU-CVE-2024-3177- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVAZL-40016 No score
CVE-2024-3177 affecting package kubernetes for versions less than 1.30.1-1
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
AZL-40016- Updated
- 2026-11-02
OSVAZL-40051 No score
CVE-2024-3177 affecting package kubernetes 1.28.4-25
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
- Record
AZL-40051- Updated
- 2026-11-02
OSVGO-2024-2746 No score
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes
- Record
GO-2024-2746- Updated
- 2026-11-02
OSVMGASA-2024-0389 No score
Updated kubernetes packages fix security vulnerabilities
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated. CVE-2024-3177 The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes. CVE-2024-10220
- Record
MGASA-2024-0389- Updated
- 2026-11-02
OSVSUSE-SU-2024:1403-1 No score
Security update for kubernetes1.24
This update for kubernetes1.24 fixes the following issues:
- CVE-2024-3177: Fixed bypass of mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539)
- Record
SUSE-SU-2024:1403-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1404-1 No score
Security update for kubernetes1.23
This update for kubernetes1.23 fixes the following issues:
- CVE-2024-3177: Fixed bypass of mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539)
- Record
SUSE-SU-2024:1404-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3341-1 No score
Security update for kubernetes1.23
This update for kubernetes1.23 fixes the following issues:
- CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400)
- CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
- CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631)
- CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869)
- CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
- CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)
- CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964)
- CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539)
- CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)
Bug fixes:
- Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
- Fix multiple issues for successful
kubeadm initrun. (bsc#1214406) - Update go to version 1.22.5 in build requirements. (bsc#1229858)
- Record
SUSE-SU-2024:3341-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3343-1 No score
Security update for kubernetes1.24
This update for kubernetes1.24 fixes the following issues:
- CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400)
- CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
- CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631)
- CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869)
- CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
- CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)
- CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964)
- CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539)
- CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)
Bug fixes:
- Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
- Fix multiple issues for successful
kubeadm initrun. (bsc#1214406) - Update go to version 1.22.5 in build requirements. (bsc#1229858)
- Record
SUSE-SU-2024:3343-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02423-1 No score
Security update for kubernetes1.23
This update for kubernetes1.23 fixes the following issues:
- CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).
- CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).
- CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).
- CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539).
- CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865).
- Record
SUSE-SU-2025:02423-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02423-2 No score
Security update for kubernetes1.23
This update for kubernetes1.23 fixes the following issues:
- CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).
- CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).
- CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).
- CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539).
- CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865).
- Record
SUSE-SU-2025:02423-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
k8s.io/kubernetesGo |
before 1.27.13 | 1.27.13 |
k8s.io/kubernetesGo |
1.29.0 to 1.29.3 | 1.29.4 |
k8s.io/kubernetesGo |
1.28.0 to 1.28.8 | 1.28.9 |
kubernetesAzure Linux:3 |
before 1.30.1-1 | 1.30.1-1 |
kubernetesAzure Linux:2 |
through 1.28.4-25 | None known |
kubernetesDebian:12 |
before 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
kubernetesDebian:13 |
before 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
kubernetesDebian:14 |
before 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
k8s.io/kubernetesGo |
1.29.0 up to 1.29.4 | 1.29.4 |
k8s.io/kubernetesGo |
1.28.0 up to 1.28.9 | 1.28.9 |
Show 49 moreShow less
| Package | Affected | Fixed |
|---|---|---|
k8s.io/kubernetesGo |
before 1.27.13, 1.28.0 up to 1.28.9, 1.29.0 up to 1.29.4 | 1.27.131.28.91.29.4 |
kubernetesMageia:9 From an advisory covering 2 CVEs |
before 1.27.16-2.mga9 | 1.27.16-2.mga9 |
kubernetesopenEuler:20.03-LTS-SP1 |
before 1.20.2-21.oe1 | 1.20.2-21.oe1 |
kubernetesopenEuler:22.03-LTS-SP1 |
before 1.20.2-21.oe2203sp1 | 1.20.2-21.oe2203sp1 |
kubernetesopenEuler:22.03-LTS-SP2 |
before 1.20.2-21.oe2203sp2 | 1.20.2-21.oe2203sp2 |
kubernetesopenEuler:20.03-LTS-SP4 |
before 1.20.2-21.oe2003sp4 | 1.20.2-21.oe2003sp4 |
kubernetesopenEuler:22.03-LTS |
before 1.20.2-23.oe2203 | 1.20.2-23.oe2203 |
kubernetesopenEuler:22.03-LTS-SP3 |
before 1.20.2-21.oe2203sp3 | 1.20.2-21.oe2203sp3 |
microshiftRed Hat:openshift:4.16::el9 From an advisory covering 2 CVEs |
before 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 | 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 |
microshift-greenbootRed Hat:openshift:4.16::el9 From an advisory covering 2 CVEs |
before 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 | 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 |
microshift-multusRed Hat:openshift:4.16::el9 From an advisory covering 2 CVEs |
before 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 | 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 |
microshift-multus-release-infoRed Hat:openshift:4.16::el9 From an advisory covering 2 CVEs |
before 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 | 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 |
microshift-networkingRed Hat:openshift:4.16::el9 From an advisory covering 2 CVEs |
before 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 | 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 |
microshift-olmRed Hat:openshift:4.16::el9 From an advisory covering 2 CVEs |
before 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 | 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 |
microshift-olm-release-infoRed Hat:openshift:4.16::el9 From an advisory covering 2 CVEs |
before 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 | 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 |
microshift-release-infoRed Hat:openshift:4.16::el9 From an advisory covering 2 CVEs |
before 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 | 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 |
microshift-selinuxRed Hat:openshift:4.16::el9 From an advisory covering 2 CVEs |
before 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 | 0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 |
openshiftRed Hat:openshift:4.14::el8 From an advisory covering 2 CVEs |
before 0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el8 | 0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.14::el8 From an advisory covering 2 CVEs |
before 0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el8 | 0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el8 |
openshiftRed Hat:openshift:4.14::el9 From an advisory covering 2 CVEs |
before 0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el9 | 0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el9 |
openshift-hyperkubeRed Hat:openshift:4.14::el9 From an advisory covering 2 CVEs |
before 0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el9 | 0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el9 |
skopeoRed Hat:openshift:4.14::el8 From an advisory covering 2 CVEs |
before 2:1.11.3-0.1.rhaos4.14.el8 | 2:1.11.3-0.1.rhaos4.14.el8 |
skopeo-debuginfoRed Hat:openshift:4.14::el8 From an advisory covering 2 CVEs |
before 2:1.11.3-0.1.rhaos4.14.el8 | 2:1.11.3-0.1.rhaos4.14.el8 |
skopeo-debugsourceRed Hat:openshift:4.14::el8 From an advisory covering 2 CVEs |
before 2:1.11.3-0.1.rhaos4.14.el8 | 2:1.11.3-0.1.rhaos4.14.el8 |
skopeo-testsRed Hat:openshift:4.14::el8 From an advisory covering 2 CVEs |
before 2:1.11.3-0.1.rhaos4.14.el8 | 2:1.11.3-0.1.rhaos4.14.el8 |
skopeoRed Hat:openshift:4.14::el9 From an advisory covering 2 CVEs |
before 2:1.11.3-0.1.rhaos4.14.el9 | 2:1.11.3-0.1.rhaos4.14.el9 |
skopeo-debuginfoRed Hat:openshift:4.14::el9 From an advisory covering 2 CVEs |
before 2:1.11.3-0.1.rhaos4.14.el9 | 2:1.11.3-0.1.rhaos4.14.el9 |
skopeo-debugsourceRed Hat:openshift:4.14::el9 From an advisory covering 2 CVEs |
before 2:1.11.3-0.1.rhaos4.14.el9 | 2:1.11.3-0.1.rhaos4.14.el9 |
skopeo-testsRed Hat:openshift:4.14::el9 From an advisory covering 2 CVEs |
before 2:1.11.3-0.1.rhaos4.14.el9 | 2:1.11.3-0.1.rhaos4.14.el9 |
kubernetes1.24SUSE:Linux Enterprise Module for Containers 15 SP5 |
before 1.24.17-150500.3.16.1 | 1.24.17-150500.3.16.1 |
kubernetes1.24openSUSE:Leap 15.5 |
before 1.24.17-150500.3.16.1 | 1.24.17-150500.3.16.1 |
kubernetes1.23SUSE:Linux Enterprise Module for Containers 15 SP5 |
before 1.23.17-150500.3.12.1 | 1.23.17-150500.3.12.1 |
kubernetes1.23openSUSE:Leap 15.5 |
before 1.23.17-150500.3.12.1 | 1.23.17-150500.3.12.1 |
kubernetes1.24SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 9 CVEs |
before 1.24.17-150400.9.16.1 | 1.24.17-150400.9.16.1 |
kubernetes1.24SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 9 CVEs |
before 1.24.17-150400.9.16.1 | 1.24.17-150400.9.16.1 |
kubernetes1.24SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 9 CVEs |
before 1.24.17-150400.9.16.1 | 1.24.17-150400.9.16.1 |
kubernetes1.24SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 9 CVEs |
before 1.24.17-150400.9.16.1 | 1.24.17-150400.9.16.1 |
kubernetes1.24SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 9 CVEs |
before 1.24.17-150300.7.6.1 | 1.24.17-150300.7.6.1 |
kubernetes1.24SUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 9 CVEs |
before 1.24.17-150300.7.6.1 | 1.24.17-150300.7.6.1 |
kubernetes1.24SUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 9 CVEs |
before 1.24.17-150300.7.6.1 | 1.24.17-150300.7.6.1 |
kubernetes1.24SUSE:Enterprise Storage 7.1 From an advisory covering 9 CVEs |
before 1.24.17-150300.7.6.1 | 1.24.17-150300.7.6.1 |
kubernetes1.23SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
kubernetes1.23SUSE:Enterprise Storage 7.1 From an advisory covering 5 CVEs |
before 1.23.17-150300.7.12.1 | 1.23.17-150300.7.12.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Cgv-Dev/Metasploit-Module-TFM | 2024-09-05 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-3177 is a low vulnerability (CVSS 2.7) in Kubernetes, published April 22, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. Fixed in k8s.io/kubernetes 1.27.13.
References
groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ
github.com/kubernetes/kubernetes/issues/124336
lists.fedoraproject.org/archives/list/[email protected]/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC
openwall.com/lists/oss-security/2024/04/16/4
nvd.nist.gov/vuln/detail/CVE-2024-3177
Show 90 moreShow less
pkg.go.dev/vuln/GO-2024-2746
security-tracker.debian.org/tracker/CVE-2024-3177
advisories.mageia.org/MGASA-2024-0389.html
bugs.mageia.org/show_bug.cgi?id=33143
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1550
access.redhat.com/errata/RHSA-2024:0043
bugzilla.redhat.com/show_bug.cgi?id=2268046
issues.redhat.com/browse/OCPBUGS-21901
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0043.json
cve.org/CVERecord?id=CVE-2024-3177
discuss.kubernetes.io/t/security-advisory-cve-2024-3177-bypassing-mountable-secrets-policy-imposed-by-the-serviceaccount-admission-plugin/27905
go.dev/cl/569356
suse.com/support/update/announcement/2024/suse-su-20241403-1
bugzilla.suse.com/1222539
ubuntu.com/security/CVE-2024-3177