Database/Container, Kubernetes & orchestration

Kubernetes (kubelet): Arbitrary command execution on the node via a gitRepo volume

CVSS 8.1CVE-2024-10220Container, Kubernetes & orchestrationcurated

Impact

Arbitrary command execution on the node via a gitRepo volume

Who can reach it

Cluster user able to create a pod with a gitRepo volume

What to do

Rolling kubelet upgrade with node drain; block the deprecated gitRepo volume type by admission policy

References

https://kubernetes.io/docs/reference/issues-security/official-cve-feed/

Related entries

Kubernetes (kubelet): Windows workloads run as ContainerAdministrator despite runAsNonRootCVE-2021-25749 · Kubernetes (kubelet)High
Kubernetes (kubelet): gitRepo volume grants inadvertent access to local repositories on the nodeCVE-2025-1767 · Kubernetes (kubelet)Medium
Kubernetes (kubelet): Unauthenticated node DoS through the kubelet checkpoint API filling node diskCVE-2025-0426 · Kubernetes (kubelet)Medium
Kubernetes (kubelet): Incorrect permissions on Windows container log directories allow privilege escalationCVE-2024-5321 · Kubernetes (kubelet)Medium
Kubernetes (kubelet): Command injection on Windows nodes via the nodes/*/logs/query APICVE-2024-9042 · Kubernetes (kubelet)Medium
Kubernetes (kubelet): Pod writes to its own /etc/hosts unaccounted for in evictionCVE-2020-8557 · Kubernetes (kubelet)Medium

All Container, Kubernetes & orchestration entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.