Privilege escalation in External-Secrets
CVE-2024-45041
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It also has path/update verb of validatingwebhookconfigurations resources. This can be used to abuse the SA token of the deployment to retrieve or get ALL secrets in the whole cluster, capture and log all data from requests attempting to update Secrets, or make a webhook deny all Pod create and update requests. This vulnerability is fixed in 0.10.2.
Vulnerability class: Privilege Escalation
EPSS: 0.006 (44.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H.
Affected products
- External-secrets — versions < 0.10.2
- External-secrets External_secrets_operator
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-45041?
- CVE-2024-45041 is a high-severity vulnerability in External-Secrets, classified under Improper Privilege Management. CVSS score: 8.3/10. Published 2024-09-09.
- How severe is CVE-2024-45041?
- High severity. CVSS v3 base score is 8.3 out of 10.
- Is CVE-2024-45041 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.