CVE-2024-3744
Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
- Record
CVE-2024-3744- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2024-1746
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
- Record
EUVD-2024-1746- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qjqg-4wg7-957h
azure-file-csi-driver leaks service account tokens in the logs
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
- Record
GHSA-qjqg-4wg7-957h- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
NVD
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
- Record
CVE-2024-3744- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
- Record
CVE-2024-3744- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVGHSA-qjqg-4wg7-957h
azure-file-csi-driver leaks service account tokens in the logs
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
- Record
GHSA-qjqg-4wg7-957h- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVGO-2024-2861 No score
azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver
azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver
- Record
GO-2024-2861- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sigs.k8s.io/azurefile-csi-driverGo |
through 1.29.3 | 1.29.4 |
sigs.k8s.io/azurefile-csi-driverGo |
1.30.0 to 1.30.0 | 1.30.1 |
sigs.k8s.io/azurefile-csi-driverGo |
before 1.29.4 | 1.29.4 |
sigs.k8s.io/azurefile-csi-driverGo |
1.30.0 up to 1.30.1 | 1.30.1 |
sigs.k8s.io/azurefile-csi-driverGo |
before 1.29.4, 1.30.0 up to 1.30.1 | 1.29.41.30.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-3744 is a medium vulnerability (CVSS 6.5) in Kubernetes Azure-file-csi-driver, published May 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in sigs.k8s.io/azurefile-csi-driver 1.29.4.
References
groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ
github.com/kubernetes/kubernetes/issues/124759
openwall.com/lists/oss-security/2024/05/09/4
nvd.nist.gov/vuln/detail/CVE-2024-3744