CVE-2024-3177

🗓️ 22 Apr 2024 23:00:39Reported by kubernetesType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 391 Views🌐 WEB

Kubernetes security issue bypassing secrets policy in containers

Reporter	Title	Published	Views	Family All 173
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Kubernetes kube-apiserver [ CVE-2024-3177]	1 Aug 202416:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple vulnerabilities	31 Jul 202514:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	26 Mar 202503:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.4 addresses multiple security vulnerabilities	15 Apr 202502:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2024-3177)	29 Apr 202409:37	–	ibm
BDU FSTEC	KUBE-APISERVER Container Bypass Security Policies	27 May 202400:00	–	bdu_fstec
CBLMariner	CVE-2024-3177 affecting package kubernetes for versions less than 1.30.1-1	21 Jun 202409:32	–	cbl_mariner
Chainguard	CVE-2024-3177 vulnerabilities	22 Apr 202423:15	–	cgr
Circl	CVE-2024-3177	23 Feb 202614:54	–	circl
CNNVD	Kubernetes input validation error vulnerability	22 Apr 202400:00	–	cnnvd

[
  {
    "defaultStatus": "unaffected",
    "product": "Kubernetes",
    "vendor": "Kubernetes",
    "versions": [
      {
        "lessThanOrEqual": "1.27.12",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "v1.28.0 - v1.28.8"
      },
      {
        "status": "affected",
        "version": "v1.29.0 - v1.29.3"
      }
    ]
  }
]

Source	Link
groups	www.groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ
github	www.github.com/kubernetes/kubernetes/issues/124336
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/
openwall	www.openwall.com/lists/oss-security/2024/04/16/4

Parameter	Position	Path	Description	CWE
envFrom	path	/api/v1	Kubernetes API endpoint where a pod can be created with 'envFrom' populated to bypass mountable secrets policy (CVE-2024-3177).	CWE-20
spec.containers[].envFrom	request body	/api/v1	Vulnerable parameters in the Pod creation request body that allow bypassing mountable secrets policy via the envFrom field.	CWE-20
spec.initContainers[].envFrom	request body	/api/v1	Vulnerable parameters in the Pod creation request body that allow bypassing mountable secrets policy via the envFrom field.	CWE-20
spec.ephemeralContainers[].envFrom	request body	/api/v1	Vulnerable parameters in the Pod creation request body that allow bypassing mountable secrets policy via the envFrom field.	CWE-20
spec.ephemeralContainers	request body	/api/v1	Vulnerable parameter in the Pod creation request body allowing the addition of ephemeral containers to access secrets (CVE-2023-2728/CVE-2024-3177).	CWE-20

17 Jun 2026 07:43Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.12.7

EPSS0.02224

SSVC

CWE-20