CVE-2024-41820CWE-732

Cluster-level privilege escalation in kubean

Medium · published August 5, 2024

CVSS v3.1
6.0
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00414 · 34.6th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2024-08-05T20:07Z
EPSS history
Timeline
  • 05 AUG 20:07Z
    Cluster-level privilege escalation in kubean
    cvelistv5