CVE-2024-3177

lowpriority · track · 11EPSS 0.022 · 83 %ileexploit · PoCDEEUFRRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

2.22% (83rd) EPSS

CVSS 2.7 · low

Is it mine?

46 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.

cvss

Technical severity, 0–10. One row per scoring source.

2.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.12.7lowAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · jordan@liggitt.netexploitability 1.2 · impact 1.4

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · OSV

v3.12.6lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20US

exploits (1)

Public proof-of-concept and weaponised exploit code.

Cgv-Dev/Metasploit-Module-TFMModule written in Ruby with the objective of exploiting vulnerabilities CVE-2023-2728 and CVE-2024-3177, both related to the secret mount policy in a Kubernetes cluster using a custom Metasploit module. Part of a Cybersecurity Master's degree finalization project.PoC · poc_in_github

affected products (46)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Ansible Automation Platformall versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4
Red Hat OpenShift <4.16.24all versionscert_bundDE
Red Hat OpenShift API for Data Protection 1all versionscert_bundDEcpe:/a:redhat:openshift:api_for_data_protection_1
Red Hat OpenShift Container Platform <4.12.63all versionscert_bundDE
Red Hat OpenShift Container Platform <4.14.38all versionscert_bundDE
Red Hat OpenShift Container Platform <4.15.28all versionscert_bundDE
Red Hat OpenShift Container Platform <4.16.0all versionscert_bundDE
Red Hat OpenShift Container Platform <4.16.1all versionscert_bundDE
Red Hat OpenShift Container Platform <4.16.23all versionscert_bundDE
Red Hat OpenShift Container Platform <4.18.10all versionscert_bundDE
Red Hat OpenShift Kube Descheduler Operator 5all versionscert_bundDEcpe:/a:redhat:openshift:kube_descheduler_operator_5
Red Hat OpenShift Run Once Duration Override Operator 1all versionscert_bundDEcpe:/a:redhat:openshift:run_once_duration_override_operator_1
Red Hat OpenShift Secondary Scheduler Operatorall versionscert_bundDEcpe:/a:redhat:openshift:::secondary_scheduler_operator
Red Hat OpenShift Virtualization <4.15.5all versionscert_bundDE

showing 20 of 46

advisories (6)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-0904Kubernetes: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2024-04-16csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Kubernetes ausnutzen, um Informationen offenzulegen.
WID-SEC-W-2024-1474Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2024-06-27csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.
GHSA-pxhw-596r-rwq5Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin2024-04-23ghsa · osvUS
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
CGA-rrj8-p3g2-29522024-06-06vendor · osvUS
GO-2024-2746Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes2024-06-04vendor · osvUS
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund certfr NVD CVE.org MITRE

published 2024-04-22modified 2026-06-17

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan