CVE-2025-1767

Description

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.

Reserved 2025-02-27 | Published 2025-03-13 | Updated 2025-03-13 | Assigner kubernetes

Problem types

CWE-20 Improper Input Validation

Product status

Default status
unaffected

<=v1.32.2
affected

Credits

Christophe Hauquiert finder

References

github.com/kubernetes/kubernetes/pull/130786

groups.google.com/...ernetes-security-announce/c/19irihsKg7s

cve.org (CVE-2025-1767)

nvd.nist.gov (CVE-2025-1767)

Download JSON