CVE-2024-9042 Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API
A vulnerability in Kubernetes Kubelet on Windows worker nodes can lead to denial of service, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-9042?
CVE-2024-9042 is a medium-severity vulnerability in Kubernetes Kubelet, published on 13 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.
Weakness: CWE-20
Which versions are affected by CVE-2024-9042?
9 open source packages ship an affected version, including k8s.io/kubernetes.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | All versions | 1.29.13, 1.30.9, 1.31.5, 1.32.1 |
k8s.io/kubernetes Go | All versions | 1.29.13 |
k8s.io/kubernetes Go | All versions | 1.29.13 |
k8s.io/kubernetes Go | From 1.30.0-alpha.0 | 1.30.9 |
k8s.io/kubernetes Go | From 1.30.0-alpha.0 | 1.30.9 |
k8s.io/kubernetes Go | From 1.31.0-alpha.0 | 1.31.5 |
3 more packages
k8s.io/kubernetes Go | From 1.31.0-alpha.0 | 1.31.5 |
k8s.io/kubernetes Go | From 1.32.0-alpha.0 | 1.32.1 |
k8s.io/kubernetes Go | From 1.32.0-alpha.0 | 1.32.1 |
How do I fix CVE-2024-9042?
Upgrade k8s.io/kubernetes to a fixed version for your release line: 1.29.13, 1.30.9, 1.31.5 or 1.32.1.
Is CVE-2024-9042 being exploited?
There is no known exploitation of CVE-2024-9042 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-ZW38878, ECHO-0ded-644a-1f25, GHSA-vv39-3w5q-974q, GO-2025-3522, MINI-4wvr-cc83-2cp5, MINI-6hq3-8g62-9rcv and 2 more.