https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 19:59:49 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-04398 bdu:2024-04398 https://cve.radiocsirt.org/vuln/bdu:2024-04398 https://cve.radiocsirt.org/vuln/euvd-2026-244369 EUVD-2026-244369 https://cve.radiocsirt.org/vuln/euvd-2026-244369 https://cve.radiocsirt.org/vuln/fkie_cve-2023-30617 <p>Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the &#34;captured&#34; secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.</p> <p>Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the &#34;captured&#34; secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-30617 https://cve.radiocsirt.org/vuln/ghsa-437m-7hj5-9mpw <p><strong>Affected:</strong> Go: github.com/openkruise/kruise</p> <p>### Impact Attacker that has gain root privilege of the node that kruise-daemon run , can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, attackers can leverage the &#34;captured&#34; secrets (e.g. the kruise-manager service account token) to gain extra privilege such as pod modification.</p> <p>### Workarounds For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege</p> <p>### Patches</p> <p>For users who&#39;re using v0.8.x ~ v1.2.x, please update the v1.3.1 For users who&#39;re using v1.3, please update the v1.3.1 For users who&#39;re using v1.4, please update the v1.4.1 For users who&#39;re using v1.5, please update the v1.5.2 ### References None</p> <p><strong>Affected:</strong> Go: github.com/openkruise/kruise</p> <p>### Impact Attacker that has gain root privilege of the node that kruise-daemon run , can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, attackers can leverage the &#34;captured&#34; secrets (e.g. the kruise-manager service account token) to gain extra privilege such as pod modification.</p> <p>### Workarounds For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege</p> <p>### Patches</p> <p>For users who&#39;re using v0.8.x ~ v1.2.x, please update the v1.3.1 For users who&#39;re using v1.3, please update the v1.3.1 For users who&#39;re using v1.4, please update the v1.4.1 For users who&#39;re using v1.5, please update the v1.5.2 ### References None</p> https://cve.radiocsirt.org/vuln/ghsa-437m-7hj5-9mpw https://cve.radiocsirt.org/vuln/gsd-2023-30617 gsd-2023-30617 https://cve.radiocsirt.org/vuln/gsd-2023-30617