CVE-2024-33394

In KubeVirt v1.2.0 and earlier, a ClusterRole is granted the ability to list secrets across the cluster, violating the principle of least privilege. This design flaw allows an attacker who obtains a token bound to that ClusterRole to list all secrets in the Kubernetes cluster [2].

An attacker must first steal a token from a service account that has this ClusterRole bound. The gist reference provides an example of stealing a token from a DaemonSet (e.g., hwameistor-loc...). Once the token is obtained, the attacker can use it to list secrets without further authentication [2].

With access to all secrets, the attacker can extract credentials, service account tokens, and other sensitive data. This can lead to privilege escalation and potentially full compromise of the Kubernetes cluster [2].

As of the publication date, the vulnerability affects KubeVirt versions up to and including v1.2.0. Users should upgrade to a patched version or restrict the ClusterRole permissions to mitigate the risk. No official patch is mentioned in the references, but the issue is acknowledged [2].