CVE-2024-41820

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-41820

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41820.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-41820

Aliases

Published

2024-08-05T20:07:49Z

Modified

2026-10-21T02:51:36Z

Severity

6.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H CVSS Calculator

Summary

Cluster-level privilege escalation in kubean

Details

Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-732"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41820.json"
}

References

Affected packages

Git / github.com/kubean-io/kubean

Affected ranges

Type

GIT

Repo

https://github.com/kubean-io/kubean

Events

Introduced

Fixed

d2793f4dde1bc870c2f0b25ff128550b46dc2129

Fixed

167e97329e4a27ba2f456d2846d39af20e1af7ef

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.18.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "167e97329e4a27ba2f456d2846d39af20e1af7ef"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*

v0.0.0

v0.0.1

v0.1.0

v0.1.1

v0.10.0

v0.11.0

v0.11.1

v0.11.2

v0.12.0

v0.12.1

v0.12.2

v0.13.0

v0.13.1

v0.13.10

v0.13.11

v0.13.2

v0.13.3

v0.13.4

v0.13.5

v0.13.6

v0.13.7

v0.13.8

v0.13.9

v0.14.0

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.17.2

v0.17.3

v0.17.4

v0.17.5

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.4.0

v0.4.0-rc1

v0.4.0-rc2

v0.4.0-rc3

v0.4.0-rc4

v0.4.0-rc5

v0.4.0-rc6

v0.4.0-rc7

v0.4.0-rc8

v0.4.1

v0.4.1-rc1

v0.4.1-rc10

v0.4.1-rc2

v0.4.1-rc3

v0.4.1-rc4

v0.4.1-rc5

v0.4.1-rc6

v0.4.1-rc7

v0.4.1-rc8

v0.4.1-rc9

v0.4.10

v0.4.2

v0.4.2-rc1

v0.4.2-rc10

v0.4.2-rc2

v0.4.2-rc3

v0.4.2-rc4

v0.4.2-rc5

v0.4.2-rc6

v0.4.2-rc7

v0.4.2-rc8

v0.4.2-rc9

v0.4.3

v0.4.3-rc1

v0.4.4

v0.4.4-rc1

v0.4.4-rc2

v0.4.4-rc3

v0.4.5

v0.4.5-rc1

v0.4.5-rc10

v0.4.5-rc2

v0.4.5-rc3

v0.4.5-rc4

v0.4.5-rc5

v0.4.5-rc6

v0.4.5-rc8

v0.4.5-rc9

v0.4.6

v0.4.6-rc1

v0.4.7

v0.4.8

v0.4.9

v0.4.9-rc1

v0.4.9-rc2

v0.5.0

v0.5.0-rc1

v0.5.1

v0.5.2

v0.5.2-rc1

v0.5.3

v0.5.4

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4-rc1

v0.9.4-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41820.json"