CVE-2024-41820
Cluster-level privilege escalation in kubean
Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cluster-level privilege escalation in kubean
Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-41820- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
EUVDEUVD-2024-2482
Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-2482- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3wfj-3x8q-hrpg
Kubean vulnerable to cluster-level privilege escalation
Impact
This ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.
Patches
=v0.18.0
References
Reporting by @younaman(Nanzi Yang) https://github.com/kubean-io/kubean/issues/1326
- Record
GHSA-3wfj-3x8q-hrpg- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-276, CWE-732
- Updated
- 2026-11-02
NVD
Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-41820- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
OSV
Cluster-level privilege escalation in kubean
Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-41820- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVGHSA-3wfj-3x8q-hrpg
Kubean vulnerable to cluster-level privilege escalation
Impact
This ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.
Patches
=v0.18.0
References
Reporting by @younaman(Nanzi Yang) https://github.com/kubean-io/kubean/issues/1326
- Record
GHSA-3wfj-3x8q-hrpg- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-276, CWE-732
- Updated
- 2026-11-02
OSVGO-2024-3039 No score
Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean
Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean
- Record
GO-2024-3039- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/kubean-io/kubeanGo |
before 0.18.0 | 0.18.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-41820 is a medium vulnerability (CVSS 6.0) in Kubean-io Kubean, published August 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 36th percentile. Fixed in github.com/kubean-io/kubean 0.18.0.
References
github.com/kubean-io/kubean/security/advisories/GHSA-3wfj-3x8q-hrpg
nvd.nist.gov/vuln/detail/CVE-2024-41820
pkg.go.dev/vuln/GO-2024-3039