CVE-2024-48921

lowPriorität · verfolgen · 11OT-Risiko · erhöhtEPSS 0.006 · 47. PerzentilDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.57% (47th) EPSS
CVSS 2.7 · low
Is it mine?
4 products
Prüfe deine Angriffsfläche
Who says so?
5 sources
cnnvd · enisa_euvd · osv · nvd

EPSS · bewertet 2026-10-27

Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.5suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.6suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobengovulncheck-vulndb-0.0.20241104T154416-5.1.noarch as component of SUSE Package Hub 12suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.7
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 2.7–8.7

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 1.2 · Auswirkung 1.4
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · OSV
v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:Nsecondary · SUSE Product Security
v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com
v4.06.6mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-863USprimärCWE-285USCWE-285USCWE-863US
05

betroffene Produkte (4)

Betroffene Produkte und Versionsbereiche.

06

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

  • SUSE-SU-2024:3911-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE

    Security update for govulncheck-vulndb

  • openSUSE-SU-2024:0350-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE

    Security update for govulncheck-vulndb

  • GHSA-qjvc-p88j-j9rmKyverno's PolicyException objects can be created in any namespace by default2024-10-29ghsa · osvUS

    ### Summary A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. ### Details By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. ### PoC 1. Administrator creates "disallow-privileged-containers" ClusterPolicy that applies to resources in the namespace "ubuntu-restricted" 2. Cluster user creates a PolicyException object for "disallow-privileged-containers" in namespace "ubuntu-restricted" 3. Cluster user creates a pod with a privileged container in "ubuntu-restricted" 4. Cluster user escalates to root on the node from the privileged container ### Impact Administrators attempting to enforce cluster security through kyverno policies, but that allow less privileged users to create resources

  • BIT-kyverno-2024-48921Kyverno's PolicyException objects can be created in any namespace by default2025-09-12vendor · osvUS

    Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.

  • GO-2024-3230Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno2024-10-30vendor · osvUS

    Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno

07

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdosvnvdsuse_csafNVDCVE.orgMITRE
veröffentlicht 2024-10-29geändert 2026-06-17
10

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan