CVE-2024-33396
karmada vulnerable to arbitrary code execution via a crafted command
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: Then maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: Then maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.
- Record
CVE-2024-33396- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2024-1826
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: Then maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.
- Record
EUVD-2024-1826- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wccg-v638-j9q2
karmada vulnerable to arbitrary code execution via a crafted command
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
GHSA-wccg-v638-j9q2- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: Then maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.
- Record
CVE-2024-33396- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-wccg-v638-j9q2
karmada vulnerable to arbitrary code execution via a crafted command
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- Record
GHSA-wccg-v638-j9q2- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGO-2024-2817 No score
karmada vulnerable to arbitrary code execution via a crafted command in github.com/karmada-io/karmada
karmada vulnerable to arbitrary code execution via a crafted command in github.com/karmada-io/karmada
- Record
GO-2024-2817- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/karmada-io/karmadaGo |
through 1.9.0 | None known |
github.com/karmada-io/karmadaGo |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-33396 is a high vulnerability (CVSS 8.4) in Karmada-io Karmada, published May 2, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile.