Read the docs
TI-2024-02977 Aliases CVE-2024-3177GHSA-pxhw-596r-rwq5

Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

Priority LOW 18CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02224 82nd percentileScored 2026-11-07
Fix Partial k8s.io/kubernetes (Go): 1.27.13, 1.29.4, 1.28.9Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetesup to 1.27.12; v1.28.0 - v1.28.8; v1.29.0 - v1.29.3—No fix listedCNA
—k8s.io/kubernetes (Go)before 1.27.131.27.13Patch availableGHSA-pxhw-596r-rwq5
—k8s.io/kubernetes (Go)1.29.0 to before 1.29.41.29.4Patch availableGHSA-pxhw-596r-rwq5
—k8s.io/kubernetes (Go)1.28.0 to before 1.28.91.28.9Patch availableGHSA-pxhw-596r-rwq5
  • Kubernetes VendorKubernetes Affected up to 1.27.12; v1.28.0 - v1.28.8; v1.29.0 - v1.29.3 Fixed in — No fix listed CNA
  • k8s.io/kubernetes (Go) Vendor— Affected before 1.27.13 Fixed in 1.27.13 Patch available GHSA-pxhw-596r-rwq5
  • k8s.io/kubernetes (Go) Vendor— Affected 1.29.0 to before 1.29.4 Fixed in 1.29.4 Patch available GHSA-pxhw-596r-rwq5
  • k8s.io/kubernetes (Go) Vendor— Affected 1.28.0 to before 1.28.9 Fixed in 1.28.9 Patch available GHSA-pxhw-596r-rwq5

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:-:*:*:*:*:*:*:*not specified by CISA-ADP—Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Kubernetes

Remediation

  • Fix · GHSA-pxhw-596r-rwq5 k8s.io/kubernetes (Go) Fixed in 1.27.13 Advisory →
  • Fix · GHSA-pxhw-596r-rwq5 k8s.io/kubernetes (Go) Fixed in 1.29.4 Advisory →
  • Fix · GHSA-pxhw-596r-rwq5 k8s.io/kubernetes (Go) Fixed in 1.28.9 Advisory →

Red Hat 2 advisories

  • RHSA-2024:0043 Released 2024-06-27 · Red Hat rating Important
    Red Hat build of MicroShift 4.16.0 security update
    • Red Hat OpenShift Container Platform 4.16 microshift-4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9, microshift-greenboot-4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9, microshift-multus-4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 +6
  • RHSA-2024:2054 Released 2024-05-02 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.23 security update
    • Red Hat OpenShift Container Platform 4.14 openshift-4.14.0-202404231437.p0.g401bb48.assembly.stream.el8, openshift-4.14.0-202404231437.p0.g401bb48.assembly.stream.el9, openshift-hyperkube-4.14.0-202404231437.p0.g401bb48.assembly.stream.el8 +5

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:2054
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:0043
Not affected: 1 product
  • Red Hat OpenShift Container Platform 4.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3177
  2. 2026-10-03 Alias added: GHSA-pxhw-596r-rwq5

References

Advisory 2

Other 10

  • TI-2025-01719 ingress-nginx admission controller RCE escalation CVSS 3.1CRITICAL 9.8
  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2025-00932 ingress-nginx controller - configuration injection via unsanitized mirror annotations CVSS 3.1HIGH 8.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2026-02839 ingress-nginx rewrite-target nginx configuration injection CVSS 3.1HIGH 8.8
  • TI-2025-18233 ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVSS 3.1HIGH 8.8
See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences