CVE-2025-1767 Kubernetes GitRepo Volume Inadvertent Local Repository Access
Attackers can execute code via the deprecated in-tree gitRepo volume feature in Kubernetes clusters using this non-default configuration.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1767?
CVE-2025-1767 is a medium-severity vulnerability in Kubernetes Kubelet, published on 13 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.
Weakness: CWE-20
Which versions are affected by CVE-2025-1767?
3 open source packages ship an affected version, including k8s.io/kubernetes.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | All versions | None |
k8s.io/kubernetes Go | All versions to 1.32.3 | None |
k8s.io/kubernetes Go | All versions to 1.32.3 | None |
Linux distribution packages (4)
kubernetes1.29 openSUSE:Tumbleweed | All versions | 1.29.15-1.1 |
kubernetes1.30 openSUSE:Tumbleweed | All versions | 1.30.11-1.1 |
kubernetes1.31 openSUSE:Tumbleweed | All versions | 1.31.7-1.1 |
kubernetes1.32 openSUSE:Tumbleweed | All versions | 1.32.3-1.1 |
How do I fix CVE-2025-1767?
Change a configuration setting.
Is CVE-2025-1767 being exploited?
There is no known exploitation of CVE-2025-1767 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-KK52429, CLEANSTART-2026-WC59490, DEBIAN-CVE-2025-1767, GHSA-3wgm-2gw2-vh5m, GO-2025-3521, MINI-2624-x379-gh8h and 49 more.