{"id":"CVE-2024-10220","aliases":["AZL-53528","AZL-53652","DEBIAN-CVE-2024-10220","EUVD-2024-3336","GHSA-27wf-5967-98gx","GO-2024-3286","MGASA-2024-0389","OESA-2024-2532","UBUNTU-CVE-2024-10220","openSUSE-SU-2024:14567-1"],"status":"published","title":"Arbitrary command execution through gitRepo volume","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03027,"percentile":0.87585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2024-11-22T16:23:00Z","modified":"2026-11-02T12:00:35Z","exploits":[{"source":"pocgithub","id":"mochizuki875/CVE-2024-10220-githooks","title":"mochizuki875/CVE-2024-10220-githooks","date":"2024-11-21","url":"https://github.com/mochizuki875/CVE-2024-10220-githooks"},{"source":"pocgithub","id":"any2sec/cve-2024-10220","title":"any2sec/cve-2024-10220","date":"2024-11-29","url":"https://github.com/any2sec/cve-2024-10220"},{"source":"pocgithub","id":"filipzag/CVE-2024-10220","title":"filipzag/CVE-2024-10220","date":"2024-12-15","url":"https://github.com/filipzag/CVE-2024-10220"},{"source":"pocgithub","id":"candranapits/poc-CVE-2024-10220","title":"candranapits/poc-CVE-2024-10220","date":"2024-12-17","url":"https://github.com/candranapits/poc-CVE-2024-10220"},{"source":"pocgithub","id":"orgC/CVE-2024-10220-demo","title":"orgC/CVE-2024-10220-demo","date":"2025-05-12","url":"https://github.com/orgC/CVE-2024-10220-demo"},{"source":"pocgithub","id":"mrk336/CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability","title":"mrk336/CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability","date":"2025-09-08","url":"https://github.com/mrk336/CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability"},{"source":"pocgithub","id":"saleha-muzammil/cve-2024-10220-git-on-git","title":"saleha-muzammil/cve-2024-10220-git-on-git","date":"2025-11-23","url":"https://github.com/saleha-muzammil/cve-2024-10220-git-on-git"},{"source":"pocgithub","id":"imohammed28/cve-2024-10220-test","title":"imohammed28/cve-2024-10220-test","date":"2025-11-30","url":"https://github.com/imohammed28/cve-2024-10220-test"}],"fixes":[{"ecosystem":"Go","package":"k8s.io/kubernetes","fixed_in":["1.28.12","1.29.7","1.30.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.30.3-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kubernetes","fixed_in":["1.28.4-14"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"kubernetes","fixed_in":["1.20.2-26.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"kubernetes","fixed_in":["1.20.2-26.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"kubernetes","fixed_in":["1.20.2-26.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"kubernetes","fixed_in":["1.20.2-26.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"kubernetes","fixed_in":["1.29.1-9.oe2403"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.12"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.0"},{"fixed":"1.30.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.4-14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.28.12"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.30.0"},{"fixed":"1.30.3"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.28.12"},{"introduced":"1.29.0"},{"fixed":"1.29.7"},{"introduced":"1.30.0"},{"fixed":"1.30.3"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.16-2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-26.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-26.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-26.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-26.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1-9.oe2403"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241209T183251-1.1"}]}],"bundled":21}],"products":[{"vendor":"kubernetes","product":"kubelet"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/128885","tags":["issue-tracking","report","web"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko","tags":["mailing-list","article","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/11/20/1","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10220","tags":["web","advisory"]},{"url":"https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3286","tags":["web"]},{"url":"https://github.com/advisories/GHSA-27wf-5967-98gx","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10220.json","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-10220","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0389.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33143","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33802","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/11/20/1","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2532","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-10220","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-10220","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8676","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-10220","title":"Arbitrary command execution through gitRepo volume","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"published","published":"2024-11-22T16:23:00.535Z","modified":"2024-11-25T18:22:59.457Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-3336","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"published","published":"2024-11-22T16:23:00Z","modified":"2024-11-25T18:22:59Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:48.805983Z"}],"ghsa":[{"id":"GHSA-27wf-5967-98gx","title":" Kubernetes kubelet arbitrary command execution","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"published","published":"2024-11-22T21:32:15Z","modified":"2024-12-13T21:45:45Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:25.334027Z"}],"nvd":[{"id":"CVE-2024-10220","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"published","published":"2024-11-22T17:15:06.65Z","modified":"2026-06-17T06:55:11.093Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:37.996328Z"}],"osv":[{"id":"CVE-2024-10220","title":"Arbitrary command execution through gitRepo volume","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"published","published":"2024-11-22T16:23:00.535Z","modified":"2026-10-28T02:30:42.449083538Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"DEBIAN-CVE-2024-10220","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"published","published":"2024-11-22T17:15:06.65Z","modified":"2026-11-02T12:00:35.149760229Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-27wf-5967-98gx","title":" Kubernetes kubelet arbitrary command execution","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"published","published":"2024-11-22T21:32:15Z","modified":"2026-09-10T03:50:20.243855183Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"OESA-2024-2532","title":"kubernetes security update","description":"Container cluster management.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability, which was classified as problematic, was found in Kubernetes up to 1.28.11/1.29.6/1.30.2 (Virtualization Software). Affected is an unknown code block of the component gitRepo Volume Handler. Upgrading to version 1.28.12, 1.29.7, 1.30.3 or 1.31.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2024-10220)","status":"published","published":"2024-12-13T11:08:01Z","modified":"2026-08-18T01:18:42.669137998Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-10220","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"withdrawn","published":"2024-11-22T17:15:00Z","modified":"2025-07-14T06:46:34.139156Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"AZL-53528","title":"CVE-2024-10220 affecting package kubernetes for versions less than 1.30.3-1","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"published","published":"2024-11-22T17:15:06Z","modified":"2026-04-21T04:56:09.732525Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-53652","title":"CVE-2024-10220 affecting package kubernetes for versions less than 1.28.4-14","description":"The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.","status":"published","published":"2024-11-22T17:15:06Z","modified":"2026-04-21T04:35:19.456847Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"GO-2024-3286","title":"Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes","description":"Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes","status":"published","published":"2024-11-27T19:16:39Z","modified":"2026-02-04T02:23:56.591231Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"MGASA-2024-0389","title":"Updated kubernetes packages fix security vulnerabilities","description":"A security issue was discovered in Kubernetes where users may be able to\nlaunch containers that bypass the mountable secrets policy enforced by\nthe ServiceAccount admission plugin when using containers, init\ncontainers, and ephemeral containers with the envFrom field populated.\nThe policy ensures pods running with a service account may only\nreference secrets specified in the service account’s secrets field.\nKubernetes clusters are only affected if the ServiceAccount admission\nplugin and the kubernetes.io/enforce-mountable-secrets annotation are\nused together with containers, init containers, and ephemeral containers\nwith the envFrom field populated. CVE-2024-3177\nThe Kubernetes kubelet component allows arbitrary command execution via\nspecially crafted gitRepo volumes. CVE-2024-10220\n","status":"published","published":"2024-12-06T17:09:22Z","modified":"2026-04-16T04:44:02.557268952Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14567-1","title":"govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-11T00:00:00Z","modified":"2026-02-04T02:48:53.761072Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}