CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 2CVE-2024-3177 – Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
https://notcve.org/view.php?id=CVE-2024-3177
22 Apr 2024 — A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/en... • https://github.com/FreySolarEye/Exploit-CVE-2024-31777 • CWE-20: Improper Input Validation CWE-213: Exposure of Sensitive Information Due to Incompatible Policies •
CVSS: 9.0EPSS: 0%CPEs: 7EXPL: 0CVE-2023-5528 – Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-5528
14 Nov 2023 — A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods y volúmenes persistentes en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ... • https://github.com/kubernetes/kubernetes/issues/121879 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3676 – Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-3676
29 Aug 2023 — A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que pueda crear pods en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si incluyen nodos de Windows. A vulnerability was found in Kuberne... • https://github.com/kubernetes/kubernetes/issues/119339 • CWE-20: Improper Input Validation CWE-269: Improper Privilege Management •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3955 – Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-3955
29 Aug 2023 — A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si incluyen nodos de Windows. A vulnerability was found in Kuberne... • https://github.com/kubernetes/kubernetes/issues/119595 • CWE-20: Improper Input Validation CWE-269: Improper Privilege Management •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 1CVE-2023-2728 – Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin
https://notcve.org/view.php?id=CVE-2023-2728
03 Jul 2023 — Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers. A flaw was found in Kubernetes, wher... • https://github.com/Cgv-Dev/Metasploit-Module-TFM • CWE-20: Improper Input Validation •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2023-2727 – Bypassing policies imposed by the ImagePolicyWebhook admission plugin
https://notcve.org/view.php?id=CVE-2023-2727
03 Jul 2023 — Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. A flaw was found in Kubernetes, where users may be able to launch containers using images restricted by the ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together wi... • http://www.openwall.com/lists/oss-security/2023/07/06/2 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-2431 – Bypass of seccomp profile enforcement
https://notcve.org/view.php?id=CVE-2023-2431
16 Jun 2023 — A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. A flaw was found in Kubernetes. • https://github.com/kubernetes/kubernetes/issues/118690 • CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30513
https://notcve.org/view.php?id=CVE-2023-30513
12 Apr 2023 — Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled. • http://www.openwall.com/lists/oss-security/2023/04/13/3 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3294 – Node address isn't always verified when proxying
https://notcve.org/view.php?id=CVE-2022-3294
01 Mar 2023 — Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing thi... • https://github.com/kubernetes/kubernetes/issues/113757 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3162 – Unauthorized read of Custom Resources
https://notcve.org/view.php?id=CVE-2022-3162
18 Jan 2023 — Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group. • https://github.com/kubernetes/kubernetes/issues/113756 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •