~ / search / GHSA-3wfj-3x8q-hrpg

GHSA-3wfj-3x8q-hrpg

Kubean vulnerable to cluster-level privilege escalation

Source: GitHub Advisory Database (reviewed) High CVE-2024-41820

Packages

EcosystemPackageAffectedFixed in
Go github.com/kubean-io/kubean < 0.18.0 0.18.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact This ClusterRole has `*` verbs of `*` resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. ### Patches >=v0.18.0 ### References Reporting by @younaman(Nanzi Yang) https://github.com/kubean-io/kubean/issues/1326

References

External links from the advisory. They lead to third-party sites.