Every CVE Search/ Get API key

CVE-2024-7598

Network restriction bypass via race condition during namespace termination

3.1 LowFix available

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.32%Up 0.3 points since Mar 21, 2025
90%50%10%1%

What each source reports

CVE List Score used 3.1

Network restriction bypass via race condition during namespace termination

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
CVE-2024-7598
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-362
Updated
2026-11-02
EUVDEUVD-2025-7150 3.1

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
EUVD-2025-7150
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-r56h-j38w-hrqq 3.1

Kubernetes kube-apiserver Vulnerable to Race Condition

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
GHSA-r56h-j38w-hrqq
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-362
Updated
2026-11-02
NVD 3.1

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
CVE-2024-7598
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-362
Updated
2026-11-02
OSV 3.1

Network restriction bypass via race condition during namespace termination

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
CVE-2024-7598
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-362
Updated
2026-11-02
OSVDEBIAN-CVE-2024-7598 3.1

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
DEBIAN-CVE-2024-7598
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-r56h-j38w-hrqq 3.1

Kubernetes kube-apiserver Vulnerable to Race Condition

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
GHSA-r56h-j38w-hrqq
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-362
Updated
2026-11-02
OSVUBUNTU-CVE-2024-7598 3.1

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
UBUNTU-CVE-2024-7598
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVAZL-58953 No score

CVE-2024-7598 affecting package kubernetes for versions less than 1.30.10-27

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
AZL-58953
Updated
2026-11-05
OSVAZL-58960 No score

CVE-2024-7598 affecting package kubernetes 1.28.4-25

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

Record
AZL-58960
Updated
2026-11-02
OSVGO-2025-3547 No score

Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes

Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes

Record
GO-2025-3547
Updated
2026-11-02
OSVopenSUSE-SU-2025:14937-1 No score

govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250327T184518-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14937-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
k8s.io/kubernetes/cmd/kube-apiserver
Go
 1.3.0 to 1.32.3 None known
kubernetes
Azure Linux:3
 before 1.30.10-27
1.30.10-27
kubernetes
Azure Linux:2
 through 1.28.4-25 None known
kubernetes
Debian:12
 before 1.20.5+really1.20.2-1
1.20.5+really1.20.2-1
kubernetes
Debian:13
 before 1.20.5+really1.20.2-1
1.20.5+really1.20.2-1
kubernetes
Debian:14
 before 1.20.5+really1.20.2-1
1.20.5+really1.20.2-1
k8s.io/kubernetes
Go
 1.3.0 and later None known
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 30 CVEs
 before 0.0.20250327T184518-1.1
0.0.20250327T184518-1.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-7598 is a low vulnerability (CVSS 3.1) in Kubernetes Kube-apiserver, published March 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in kubernetes 1.30.10-27.

References

Show 35 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open