CVE-2024-41820 Cluster-level privilege escalation in kubean
Malicious users with worker node access can escalate privileges to control the entire Kubernetes cluster due to excessive RBAC permissions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41820?
CVE-2024-41820 is a medium-severity vulnerability in kubean-io kubean, published on 5 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-732
Which versions are affected by CVE-2024-41820?
3 open source packages ship an affected version, including github.com/kubean-io/kubean.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kubean-io/kubean Go | All versions | 0.18.0 |
github.com/kubean-io/kubean Go | All versions | 0.18.0 |
github.com/kubean-io/kubean Go | All versions | 0.18.0 |
How do I fix CVE-2024-41820?
Upgrade github.com/kubean-io/kubean to 0.18.0 or later.
Is CVE-2024-41820 being exploited?
There is no known exploitation of CVE-2024-41820 in the wild and no public exploit code.
Sources
Also known as GHSA-3wfj-3x8q-hrpg, GO-2024-3039.