CVE-2025-1767

Published: Mar 13, 2025Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Exploitability: 1.2 / Impact: 5.2

Source: jordan@liggitt.net (Secondary)

Description

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://github.com/kubernetes/kubernetes/pull/130786

Source: jordan@liggitt.net

https://groups.google.com/g/kubernetes-security-announce/c/19irihsKg7s

Source: jordan@liggitt.net

http://www.openwall.com/lists/oss-security/2025/03/13/9

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.