GHSA-437m-7hj5-9mpw

    Dashboard / Vulnerabilities / GHSA-437m-7hj5-9mpw

    GHSA-437m-7hj5-9mpw

    Published: 5 Jan 2024Last Modified: 10 Sept 2026

    Summary: Kruise allows leveraging the kruise-daemon pod to list all secrets in the entire cluster

    Details: ### Impact Attacker that has gain root privilege of the node that kruise-daemon run , can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, attackers can leverage the "captured" secrets (e.g. the kruise-manager service account token) to gain extra privilege such as pod modification. ### Workarounds For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege ### Patches For users who're using v0.8.x ~ v1.2.x, please update the v1.3.1 For users who're using v1.3, please update the v1.3.1 For users who're using v1.4, please update the v1.4.1 For users who're using v1.5, please update the v1.5.2 ### References None

    References: https://github.com/openkruise/kruise/security/advisories/GHSA-437m-7hj5-9mpw, https://nvd.nist.gov/vuln/detail/CVE-2023-30617, https://github.com/openkruise/kruise

    Affected packages

    Package

    Name: github.com/openkruise/kruise

    Purl: pkg:golang/github.com/openkruise/kruise

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.8.0
    Fixed -1.3.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-437m-7hj5-9mpw | CVE-DB