CVE-2024-12226 Information disclosure in Kubernetes Worker or Kubernetes Agent
Attackers can read sensitive variables from Kubernetes script pod logs due to clear-text storage in Octopus Deploy agents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12226?
CVE-2024-12226 is a medium-severity vulnerability in Octopus Deploy Kubernetes Worker or Kubernetes Agent, published on 16 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions accordingly.
Weakness: CWE-532
Which versions are affected by CVE-2024-12226?
How do I fix CVE-2024-12226?
No fix has been published for CVE-2024-12226 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-12226 being exploited?
There is no known exploitation of CVE-2024-12226 in the wild and no public exploit code.
Sources
Also known as GHSA-5w92-hhch-jqv7.