CVE-2025-1767

State: Published
Severity: 6.5 Medium
Published: Mar 13, 2025
Updated: Mar 17, 2025
Reserved: Feb 27, 2025

Description

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	kubernetes

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
KubeletKubernetes	<=v1.32.2Affected

References

https://github.com/kubernetes/kubernetes/pull/130786
https://groups.google.com/g/kubernetes-security-announce/c/19irihsKg7s
http://www.openwall.com/lists/oss-security/2025/03/13/9

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.