CVE-2024-39690 Capsule tenant owner with "patch namespace" permission can hijack system namespaces
Tenant owners can hijack unowned system namespaces by patching them, leading to privilege escalation and control over cluster resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-39690?
CVE-2024-39690 is a high-severity vulnerability in projectcapsule capsule, published on 20 Aug 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace. Version 0.7.1 contains a patch.
Weakness: CWE-863
Which versions are affected by CVE-2024-39690?
3 open source packages ship an affected version, including github.com/projectcapsule/capsule. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectcapsule/capsule Go | All versions | None |
github.com/projectcapsule/capsule Go | All versions | 0.7.1 |
github.com/projectcapsule/capsule Go | All versions | 0.7.1 |
Products include Projectcapsule Capsule.
How do I fix CVE-2024-39690?
Upgrade github.com/projectcapsule/capsule to 0.7.1 or later.
Is CVE-2024-39690 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39690 exists.
Other vulnerabilities in projectcapsule capsule
Sources
Also known as GHSA-mq69-4j5w-3qwp, GO-2024-3077.