Vulnerability in Kubernetes Kube-Apiserver
CVE-2024-7598
A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.
Vulnerability class: Race Condition
EPSS: 0.003 (22.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Kubernetes Kube-apiserver — versions 1.3.0, 0
Weakness classification (CWE)
References
- jordan@liggitt.net (issue-tracking, vendor-advisory)
- jordan@liggitt.net (mailing-list)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2024-7598?
- CVE-2024-7598 is a low-severity vulnerability in Kubernetes Kube-Apiserver, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 3.1/10. Published 2025-03-20.
- How severe is CVE-2024-7598?
- Low severity. CVSS v3 base score is 3.1 out of 10.