CVE-2024-10220 Arbitrary command execution through gitRepo volume
Attackers can execute arbitrary commands on nodes by exploiting specially crafted gitRepo volumes in Kubernetes kubelet.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-10220?
CVE-2024-10220 is a high-severity command injection vulnerability in Kubernetes kubelet, published on 22 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
Weakness: CWE-22
Which versions are affected by CVE-2024-10220?
7 open source packages ship an affected version, including k8s.io/kubernetes.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | All versions | 1.28.12, 1.29.7, 1.30.3 |
k8s.io/kubernetes Go | All versions | 1.28.12 |
k8s.io/kubernetes Go | All versions | 1.28.12 |
k8s.io/kubernetes Go | From 1.29.0 | 1.29.7 |
k8s.io/kubernetes Go | From 1.29.0 | 1.29.7 |
k8s.io/kubernetes Go | From 1.30.0 | 1.30.3 |
1 more packages
k8s.io/kubernetes Go | From 1.30.0 | 1.30.3 |
How do I fix CVE-2024-10220?
Upgrade k8s.io/kubernetes to a fixed version for your release line: 1.28.12, 1.29.7 or 1.30.3.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-10220 being exploited?
There is no known exploitation of CVE-2024-10220 in the wild and no public exploit code.
Public exploit code: 8 proofs of concept on GitHub.
Sources
Also known as AZL-53528, AZL-53652, CLEANSTART-2025-ZX75782, DEBIAN-CVE-2024-10220, GHSA-27wf-5967-98gx, GO-2024-3286 and 2 more.