kube-audit-rest's example logging configuration could disclose secret values in the audit log
Priority LOW 23CWE-200Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed kube-audit-rest (RichardoC): 1.0.16github.com/RichardoC/kube-audit-rest (Go): 0.0.0-20250205113217-9df8886b4819
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| RichardoC | kube-audit-rest | before 1.0.16 | 1.0.16 | Patch available | CNA |
| — | github.com/RichardoC/kube-audit-rest (Go) | before 0.0.0-20250205113217-9df8886b4819 | 0.0.0-20250205113217-9df8886b4819 | Patch available | GHSA-hcr5-wv4p-h2g2 |
- kube-audit-rest VendorRichardoC Affected before 1.0.16 Fixed in 1.0.16 Patch available CNA
- github.com/RichardoC/kube-audit-rest (Go) Vendor— Affected before 0.0.0-20250205113217-9df8886b4819 Fixed in 0.0.0-20250205113217-9df8886b4819 Patch available GHSA-hcr5-wv4p-h2g2
Remediation
- Fix · CNA kube-audit-rest (RichardoC) Fixed in 1.0.16
- Fix · GHSA-hcr5-wv4p-h2g2 github.com/RichardoC/kube-audit-rest (Go) Fixed in 0.0.0-20250205113217-9df8886b4819 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-24884
- 2026-10-03 Alias added: GHSA-hcr5-wv4p-h2g2
References
More RichardoC vulnerabilities
- TI-2025-38977 GitHub Workflow Updater stored the optional Github token in plaintext CVSS 3.1LOW 3.8
Sources
- CVE-2025-24884 · CVE Program
- CVE-2025-24884 · NVD
- FIRST EPSS
- GHSA-hcr5-wv4p-h2g2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences