Skip to content
Fencer Intel
critical 9.9

CVE-2022-24817 json

Improper kubeconfig validation allows arbitrary code execution

published 4y ago modified 2mo ago also BIT-flux-2022-24817 , BIT-kustomize-2022-24817 , EUVD-2022-5436 , GHSA-vvmq-fwmg-2gjc

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0

Patch / fix

  • go github.com/fluxcd/flux2 0.29.0
  • go github.com/fluxcd/kustomize-controller 0.23.0
  • go github.com/fluxcd/helm-controller 0.19.0
  • bitnami flux 0.29.0
  • bitnami kustomize 0.23.0
  • fluxcd flux2 0.29.0
  • fluxcd helm-controller 0.19.0
  • fluxcd kustomize-controller 0.23.0

Is CVE-2022-24817 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
OSV 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/fluxcd/flux2
>=0.1.0, <0.29.0
0.29.0
go github.com/fluxcd/kustomize-controller
>=0.1.0, <0.23.0
0.23.0
go github.com/fluxcd/helm-controller
>=0.2.0, <0.19.0
0.19.0
bitnami flux
>=0.1.0, <0.29.0
0.29.0
bitnami kustomize
>=0.1.0, <0.23.0
0.23.0

Affected products

  • fluxcd flux2

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.