CVE-2024-3177

🗓️ 22 Apr 2024 23:00:39Reported by kubernetesType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 380 Views🌐 WEB

Kubernetes security issue bypassing secrets policy in containers

Reporter	Title	Published	Views	Family All 166
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Kubernetes kube-apiserver [ CVE-2024-3177]	1 Aug 202416:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple vulnerabilities	31 Jul 202514:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	26 Mar 202503:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.4 addresses multiple security vulnerabilities	15 Apr 202502:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2024-3177)	29 Apr 202409:37	–	ibm
BDU FSTEC	The vulnerability of the KUBE-APISERVER component of the Kubernetes cluster management software allows a hacker to execute containers bypassing security policies.	27 May 202400:00	–	bdu_fstec
CBLMariner	CVE-2024-3177 affecting package kubernetes for versions less than 1.30.1-1	21 Jun 202409:32	–	cbl_mariner
Chainguard	CVE-2024-3177 vulnerabilities	22 Apr 202423:15	–	cgr
Circl	CVE-2024-3177	23 Feb 202614:54	–	circl
CNNVD	Kubernetes 输入验证错误漏洞	22 Apr 202400:00	–	cnnvd

[
  {
    "defaultStatus": "unaffected",
    "product": "Kubernetes",
    "vendor": "Kubernetes",
    "versions": [
      {
        "lessThanOrEqual": "1.27.12",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "v1.28.0 - v1.28.8"
      },
      {
        "status": "affected",
        "version": "v1.29.0 - v1.29.3"
      }
    ]
  }
]

Source	Link
groups	www.groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ
github	www.github.com/kubernetes/kubernetes/issues/124336
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/
openwall	www.openwall.com/lists/oss-security/2024/04/16/4

Parameter	Position	Path	Description	CWE
spec.containers[*].envFrom.secretRef.name	path	/api/v1	Bypass of mountable secrets policy via envFrom in containers, init containers, or ephemeral containers, enabling access to secrets not listed in the service account's secrets field.	CWE-20
spec.initContainers[*].envFrom.secretRef.name	path	/api/v1	Bypass of mountable secrets policy via envFrom in containers, init containers, or ephemeral containers, enabling access to secrets not listed in the service account's secrets field.	CWE-20
spec.ephemeralContainers[*].envFrom.secretRef.name	path	/api/v1	Bypass of mountable secrets policy via envFrom in containers, init containers, or ephemeral containers, enabling access to secrets not listed in the service account's secrets field.	CWE-20

17 Jun 2026 07:43Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.12.7

EPSS0.02224

SSVC

CWE-20