CVE-2024-32359

State: Published
Severity: 6.9 Medium
Published: May 2, 2024
Updated: Jul 9, 2026
Reserved: Apr 12, 2024

Description

An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of the entire cluster and further take over the cluster.

Scores

CVSS	Score	Vector	Source
3.1	6.9 Medium	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H	CISA-ADP

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/HouqiyuA/k8s-rbac-poc
https://github.com/carina-io/carina
https://gist.github.com/HouqiyuA/568d9857dab4ddba6b8b6a791e90f906

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.