CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:NCVE-2024-9779
High (7.5). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in open-cluster-management.io/ocm 0.13.0.
A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named "cluster-manager", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-266
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jhh6-6fhp-q2xp | Go | open-cluster-management.io/ocm | <0.13.0 | 0.13.0 |
| GO-2024-3343 | Go | open-cluster-management.io/ocm | <0.13.0 | 0.13.0 |
References
- https://access.redhat.com/security/cve/CVE-2024-9779
- https://bugzilla.redhat.com/show_bug.cgi?id=2317916
- https://github.com/open-cluster-management-io/ocm/pull/325
- https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0
- https://github.com/open-cluster-management-io/registration-operator/issues/361