6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
38.9%
Flux2 can reconcile the state of a remote cluster when provided with a kubeconfig with the correct access rights. Kubeconfig
files can define commands to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target cluster, could craft a kubeconfig
to execute arbitrary code inside the controller’s container.
In multi-tenancy deployments this can also lead to privilege escalation if the controller’s service account has elevated permissions.
Within the affected versions range, one of the permissions set below would be required for the vulnerability to be exploited:
Kustomization
or HelmRelease
objects and Kubernetes Secrets.kubeconfig
in existing Flux Kustomization
or HelmRelease
objects.Kustomization
or HelmRelease
objects and access to create or modify existing Kubernetes secrets.This vulnerability was fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0. Starting from the fixed versions, both controllers disable the use of command execution from kubeconfig
files by default, users have to opt-in by adding the flag --insecure-kubeconfig-exec
to the controller’s command arguments. Users are no longer allowed to refer to files in the controller’s filesystem in the kubeconfig
files provided for the remote apply feature.
spec.kubeConfig
field in Flux Kustomization
and HelmRelease
objects.The Flux engineering team found and patched this vulnerability.
If you have any questions or comments about this advisory please open an issue in the flux2 repository.
CPE | Name | Operator | Version |
---|---|---|---|
github.com/fluxcd/helm-controller | lt | 0.19.0 | |
github.com/fluxcd/kustomize-controller | lt | 0.23.0 | |
github.com/fluxcd/flux2 | lt | 0.29.0 |
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
38.9%