CVE-2024-45041

external-secrets external secrets operator

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-45041

Katalog CVE

CVSS 8.8 · High EPSS 0,59%

Kerentanan Improper Privilege Management pada external-secrets external secrets operator. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It also has path/update verb of validatingwebhookconfigurations resources. This can be used to abuse the SA token of the deployment to retrieve or get ALL secrets in the whole cluster, capture and log all data from requests attempting to update Secrets, or make a webhook deny all Pod create and update requests. This vulnerability is fixed in 0.10.2.

Rincian

Terbit di NVD
9 September 2024
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-269: Improper Privilege Management
CWE-732: Incorrect Permission Assignment for Critical Resource
EPSS (30 hari)
0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
external-secrets external secrets operator Semua versi sebelum 0.10.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.