CVE-2024-7598
lowpriority · track · 0EPSS 0.003 · 24 %ileDEEURUUSEPSS · scored 2026-10-23
A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
- Go k8s.io/kubernetes/cmd/kube-apiserver1.3.0 → 1.32.3osvUSpkg:golang/k8s.io/kubernetes/cmd/kube-apiserver
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0609Kubernetes: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-03-20csaf · cert_bundDE
Ein Angreifer aus einem angrenzenden Netzwerk kann eine Schwachstelle in Kubernetes ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- GHSA-r56h-j38w-hrqqKubernetes kube-apiserver Vulnerable to Race Condition2025-03-20ghsa · osvUS
A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.
- GO-2025-3547Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes2025-03-25vendor · osvUS
Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/03/20/2cnnvd
- https://github.com/kubernetes/kubernetes/issues/126587cnnvd
- https://groups.google.com/g/kubernetes-security-announce/c/67D7UFqiPRccnnvd
- https://vigilance.fr/vulnerability/Kubernetes-ingress-filtrering-bypass-via-Kube-apiserver-Namespace-Termination-46640cnnvd
- https://github.com/kubernetes/kubernetes/issues/126587enisa_euvd
- https://groups.google.com/g/kubernetes-security-announce/c/67D7UFqiPRcenisa_euvd
- http://www.openwall.com/lists/oss-security/2025/03/20/2nvd
- https://github.com/kubernetes/kubernetes/issues/126587nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan