Improper input validation in Kubernetes Kubelet
Priority LOW 31CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.
Summary
This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01398 72nd percentileScored 2026-11-07
Fix Partial k8s.io/kubernetes (Go): 1.29.13, 1.30.9, 1.31.5 +1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubelet | up to v1.29.12; v1.30 – v1.30.8; v1.31 – v1.31.4; v1.32 – v1.32.0 | — | No fix listed | CNA |
| — | k8s.io/kubernetes (Go) | before 1.29.13 | 1.29.13 | Patch available | GHSA-vv39-3w5q-974q |
| — | k8s.io/kubernetes (Go) | 1.30.0-alpha.0 to before 1.30.9 | 1.30.9 | Patch available | GHSA-vv39-3w5q-974q |
| — | k8s.io/kubernetes (Go) | 1.31.0-alpha.0 to before 1.31.5 | 1.31.5 | Patch available | GHSA-vv39-3w5q-974q |
| — | k8s.io/kubernetes (Go) | 1.32.0-alpha.0 to before 1.32.1 | 1.32.1 | Patch available | GHSA-vv39-3w5q-974q |
- Kubelet VendorKubernetes Affected up to v1.29.12; v1.30 – v1.30.8; v1.31 – v1.31.4; v1.32 – v1.32.0 Fixed in — No fix listed CNA
- k8s.io/kubernetes (Go) Vendor— Affected before 1.29.13 Fixed in 1.29.13 Patch available GHSA-vv39-3w5q-974q
- k8s.io/kubernetes (Go) Vendor— Affected 1.30.0-alpha.0 to before 1.30.9 Fixed in 1.30.9 Patch available GHSA-vv39-3w5q-974q
- k8s.io/kubernetes (Go) Vendor— Affected 1.31.0-alpha.0 to before 1.31.5 Fixed in 1.31.5 Patch available GHSA-vv39-3w5q-974q
- k8s.io/kubernetes (Go) Vendor— Affected 1.32.0-alpha.0 to before 1.32.1 Fixed in 1.32.1 Patch available GHSA-vv39-3w5q-974q
Remediation
- Fix · GHSA-vv39-3w5q-974q k8s.io/kubernetes (Go) Fixed in 1.29.13 Advisory →
- Fix · GHSA-vv39-3w5q-974q k8s.io/kubernetes (Go) Fixed in 1.30.9 Advisory →
- Fix · GHSA-vv39-3w5q-974q k8s.io/kubernetes (Go) Fixed in 1.31.5 Advisory →
- Fix · GHSA-vv39-3w5q-974q k8s.io/kubernetes (Go) Fixed in 1.32.1 Advisory →
Red Hat 2 advisories
- RHSA-2025:9136 Released 2025-06-16 · Red Hat rating ModerateRed Hat OpenShift for Windows Containers 10.16.2 product release
- OpenShift Windows Machine Config Operator 10.16 registry.redhat.io/openshift4-wincw/windows-machine-config-rhel9-operator
- RHSA-2025:8704 Released 2025-06-09 · Red Hat rating ImportantRed Hat OpenShift for Windows Containers 10.17.1 product release
- OpenShift Windows Machine Config Operator 10.17 registry.redhat.io/openshift4-wincw/windows-machine-config-rhel9-operator
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| OpenShift Windows Machine Config Operator 10.16 | Fixed | RHSA-2025:9136 |
| OpenShift Windows Machine Config Operator 10.17 | Fixed | RHSA-2025:8704 |
Not affected: 2 products
- OpenShift Windows Machine Config Operator 10.16
- OpenShift Windows Machine Config Operator 10.17
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9042
- 2026-10-03 Alias added: GHSA-vv39-3w5q-974q
References
Other 8
- https://github.com/kubernetes/kubernetes/issues/129654
- https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg
- https://github.com/kubernetes/kubernetes/commit/45f4ccc2153bbb782253704cbe24c05e22b5d60c
- https://github.com/kubernetes/kubernetes/commit/5fe148234f8ab1184f26069c4f7bef6c37efe347
- https://github.com/kubernetes/kubernetes/commit/75c83a6871dc030675288c6d63c275a43c2f0d55
- https://github.com/kubernetes/kubernetes/commit/fb0187c2bf7061258bb89891edb1237261eb7abc
- https://github.com/kubernetes/kubernetes
- http://www.openwall.com/lists/oss-security/2025/01/16/1
More Kubernetes vulnerabilities
- TI-2025-01719 ingress-nginx admission controller RCE escalation CVSS 3.1CRITICAL 9.8
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2025-00932 ingress-nginx controller - configuration injection via unsanitized mirror annotations CVSS 3.1HIGH 8.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2026-02839 ingress-nginx rewrite-target nginx configuration injection CVSS 3.1HIGH 8.8
- TI-2025-18233 ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVSS 3.1HIGH 8.8
Sources
- CVE-2024-9042 · CVE Program
- CVE-2024-9042 · NVD
- FIRST EPSS
- GHSA-vv39-3w5q-974q · GitHub Advisory Database · CC BY 4.0
- CVE-2024-9042 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences