Vulnerability in Kubernetes Kube-Apiserver
CVE-2024-7598
A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.
Vulnerability class: Race Condition
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (21.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 21.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Kubernetes Kube-Apiserver — versions 1.3.0, 0
Weakness classification (CWE)
References
- github.com/kubernetes/kubernetes/issues/126587 (issue-tracking, vendor-advisory)
- groups.google.com/g/kubernetes-security-announce/c/67D7UFqiPRc (mailing-list)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2024-7598?
- CVE-2024-7598 is a low-severity vulnerability in Kubernetes Kube-Apiserver, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 3.1/10. Published 2025-03-20.
- How severe is CVE-2024-7598?
- Low severity. CVSS v3 base score is 3.1 out of 10.