CVE-2024-5042
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
- CVSS 3.1
- 6.6
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-25)
- CWE
- CWE-250
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2rhx-qhxp-5jpw | Go | github.com/submariner-io/submariner-operator | >=0.16.0-m0 <0.16.4 | 0.16.4 |
| GHSA-2rhx-qhxp-5jpw | Go | github.com/submariner-io/submariner-operator | >=0.17.0-m0 <0.17.2 | 0.17.2 |
| GHSA-2rhx-qhxp-5jpw | Go | github.com/submariner-io/submariner-operator | <0.15.4 | 0.15.4 |
| GHSA-2rhx-qhxp-5jpw | Go | github.com/submariner-io/submariner-operator | >=0.18.0-m0 <0.18.0-rc0 | 0.18.0-rc0 |
| GO-2024-2866 | Go | github.com/submariner-io/submariner-operator | <0.16.4 >=0.17.0 | 0.16.4 |