Read the docs
TI-2024-04941 Aliases CVE-2024-5321GHSA-82m2-cv7p-4m75

Incorrect permissions on Windows containers logs

Priority LOW 27CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Fixed Kubernetes (Kubernetes): 1.27.16, 1.28.12, 1.29.7 +1k8s.io/kubernetes (Go): 1.27.16, 1.28.12, 1.29.7 +1Red Hat: 5 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetes1.27.0 – 1.27.15; 1.28.0 – 1.28.11; 1.29.0 – 1.29.6; 1.30.0 – 1.30.21.27.16, 1.28.12, 1.29.7, 1.30.3Patch availableCNA
—k8s.io/kubernetes (Go)before 1.27.161.27.16Patch availableGHSA-82m2-cv7p-4m75
—k8s.io/kubernetes (Go)1.28.0 to before 1.28.121.28.12Patch availableGHSA-82m2-cv7p-4m75
—k8s.io/kubernetes (Go)1.29.0 to before 1.29.71.29.7Patch availableGHSA-82m2-cv7p-4m75
—k8s.io/kubernetes (Go)1.30.0 to before 1.30.31.30.3Patch availableGHSA-82m2-cv7p-4m75
  • Kubernetes VendorKubernetes Affected 1.27.0 – 1.27.15; 1.28.0 – 1.28.11; 1.29.0 – 1.29.6; 1.30.0 – 1.30.2 Fixed in 1.27.16, 1.28.12, 1.29.7, 1.30.3 Patch available CNA
  • k8s.io/kubernetes (Go) Vendor— Affected before 1.27.16 Fixed in 1.27.16 Patch available GHSA-82m2-cv7p-4m75
  • k8s.io/kubernetes (Go) Vendor— Affected 1.28.0 to before 1.28.12 Fixed in 1.28.12 Patch available GHSA-82m2-cv7p-4m75
  • k8s.io/kubernetes (Go) Vendor— Affected 1.29.0 to before 1.29.7 Fixed in 1.29.7 Patch available GHSA-82m2-cv7p-4m75
  • k8s.io/kubernetes (Go) Vendor— Affected 1.30.0 to before 1.30.3 Fixed in 1.30.3 Patch available GHSA-82m2-cv7p-4m75

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*——Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions — — ·Kubernetes

Remediation

  • Fix · CNA Kubernetes (Kubernetes) Fixed in 1.27.16, 1.28.12, 1.29.7, 1.30.3
  • Fix · GHSA-82m2-cv7p-4m75 k8s.io/kubernetes (Go) Fixed in 1.27.16 Advisory →
  • Fix · GHSA-82m2-cv7p-4m75 k8s.io/kubernetes (Go) Fixed in 1.28.12 Advisory →
  • Fix · GHSA-82m2-cv7p-4m75 k8s.io/kubernetes (Go) Fixed in 1.29.7 Advisory →
  • Fix · GHSA-82m2-cv7p-4m75 k8s.io/kubernetes (Go) Fixed in 1.30.3 Advisory →

Red Hat 5 advisories

  • RHSA-2024:6734 Released 2024-09-17 · Red Hat rating Moderate
    Red Hat OpenShift for Windows Containers 7.2.2 product release [security update]
    • Red Hat OpenShift Container Platform 4.12 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator
  • RHSA-2024:6461 Released 2024-09-09 · Red Hat rating Moderate
    Red Hat OpenShift for Windows Containers 8.1.3 product release & security update
    • Red Hat OpenShift Container Platform 4.13 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator
  • RHSA-2024:6460 Released 2024-09-09 · Red Hat rating Moderate
    Red Hat OpenShift for Windows Containers 9.0.3 product release & security update
    • Red Hat OpenShift Container Platform 4.14 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator, openshift4/windows-machine-config-operator-bundle
Show 2 more Red Hat advisories
  • RHSA-2024:5749 Released 2024-08-22 · Red Hat rating Moderate
    Red Hat OpenShift for Windows Containers 10.16.1 product release
    • Red Hat OpenShift Container Platform 4.16 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator, openshift4/windows-machine-config-operator-bundle
  • RHSA-2024:5745 Released 2024-08-22 · Red Hat rating Moderate
    Red Hat OpenShift for Windows Containers 10.15.3 product release
    • Red Hat OpenShift Container Platform 4.15 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:6734
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2024:6461
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:6460
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2024:5745
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:5749

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-5321
  2. 2026-10-03 Alias added: GHSA-82m2-cv7p-4m75

References

Advisory 1

Other 7

  • TI-2025-01719 ingress-nginx admission controller RCE escalation CVSS 3.1CRITICAL 9.8
  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2025-00932 ingress-nginx controller - configuration injection via unsanitized mirror annotations CVSS 3.1HIGH 8.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2026-02839 ingress-nginx rewrite-target nginx configuration injection CVSS 3.1HIGH 8.8
  • TI-2025-18233 ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVSS 3.1HIGH 8.8
See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences