{"id":"CVE-2023-30617","aliases":["EUVD-2024-0237","GHSA-437m-7hj5-9mpw"],"status":"published","title":"Leverage the kruise-daemon pod to list all secrets in the entire cluster","description":"Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the \"captured\" secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00489,"percentile":0.4241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-250","CWE-269"],"published":"2024-01-03T15:29:17Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"Go","package":"github.com/openkruise/kruise","fixed_in":["1.3.1","1.4.1","1.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/openkruise/kruise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"1.3.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/openkruise/kruise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/openkruise/kruise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openkruise/kruise","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"1.3.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openkruise/kruise","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openkruise/kruise","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}]}]}],"products":[{"vendor":"openkruise","product":"kruise"}],"references":[{"url":"https://github.com/openkruise/kruise/security/advisories/GHSA-437m-7hj5-9mpw","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30617","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-437m-7hj5-9mpw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30617.json","tags":["advisory"]},{"url":"https://github.com/openkruise/kruise","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-30617","title":"Leverage the kruise-daemon pod to list all secrets in the entire cluster","description":"Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the \"captured\" secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.","status":"published","published":"2024-01-03T15:29:17.552Z","modified":"2025-06-16T18:10:14.525Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-250","CWE-269"],"updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2024-0237","description":"Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the \"captured\" secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.","status":"published","published":"2024-01-03T15:29:17Z","modified":"2025-06-16T18:10:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:23.637399Z"}],"ghsa":[{"id":"GHSA-437m-7hj5-9mpw","title":"Kruise allows leveraging the kruise-daemon pod to list all secrets in the entire cluster","description":"### Impact\nAttacker that has gain root privilege of the node that kruise-daemon run , can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, attackers can leverage the \"captured\" secrets (e.g. the kruise-manager service account token) to gain extra privilege such as pod modification. \n\n### Workarounds\nFor users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege \n\n### Patches\n\nFor users who're using v0.8.x ~ v1.2.x, please update the v1.3.1\nFor users who're using v1.3, please update the v1.3.1\nFor users who're using v1.4, please update the v1.4.1\nFor users who're using v1.5, please update the v1.5.2\n### References\nNone","status":"published","published":"2024-01-05T16:01:24Z","modified":"2024-01-05T16:01:24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-250","CWE-269"],"updated_at":"2026-11-02T14:37:29.411214Z"}],"nvd":[{"id":"CVE-2023-30617","description":"Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the \"captured\" secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.","status":"published","published":"2024-01-03T16:15:08.117Z","modified":"2026-06-17T05:55:09.483Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-250","CWE-269"],"updated_at":"2026-11-02T14:08:59.830468Z"}],"osv":[{"id":"CVE-2023-30617","title":"Leverage the kruise-daemon pod to list all secrets in the entire cluster","description":"Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the \"captured\" secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.","status":"published","published":"2024-01-03T15:29:17.552Z","modified":"2026-10-28T02:30:31.516254313Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-250","CWE-269"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-437m-7hj5-9mpw","title":"Kruise allows leveraging the kruise-daemon pod to list all secrets in the entire cluster","description":"### Impact\nAttacker that has gain root privilege of the node that kruise-daemon run , can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, attackers can leverage the \"captured\" secrets (e.g. the kruise-manager service account token) to gain extra privilege such as pod modification. \n\n### Workarounds\nFor users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege \n\n### Patches\n\nFor users who're using v0.8.x ~ v1.2.x, please update the v1.3.1\nFor users who're using v1.3, please update the v1.3.1\nFor users who're using v1.4, please update the v1.4.1\nFor users who're using v1.5, please update the v1.5.2\n### References\nNone","status":"published","published":"2024-01-05T16:01:24Z","modified":"2026-09-10T03:50:04.74683845Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-250","CWE-269"],"updated_at":"2026-11-02T15:46:36.434231Z"}]}}