CVE-2024-3177Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
- 2.7LowCVSS base score
- 2.2%Exploitation in 30 daysEPSS · top 17% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
Timeline
ID reserved
By kubernetes
- 21 days later
· 21 days later
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| kubernetesCNA (assigner) | 3.1 | Low2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Deferred | 3.1 | Low2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.2% · top 17% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.7.
Affected products
- affected ≤ 1.27.12
- affected v1.28.0 - v1.28.8
- affected v1.29.0 - v1.29.3
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gok8s.io/kubernetesGHSA-pxhw-596r-rwq5 (opens in a new tab)
What to do
Solution: To mitigate this vulnerability, upgrade Kubernetes: https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/
References
References5
- https://groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ (opens in a new tab)mailing-listx_transferred
- https://github.com/kubernetes/kubernetes/issues/124336 (opens in a new tab)issue-trackingx_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/ (opens in a new tab)x_transferred
- http://www.openwall.com/lists/oss-security/2024/04/16/4 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-1273 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-pxhw-596r-rwq5 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-3177)Record last updated .