CVE-2024-10220: Arbitrary command execution through gitRepo volume

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-22 · updated 2026-06-17
Weakness: CWE-22

Description

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Affected products

Kubernetes kubelet: through 1.28.11; from 1.29.0 through 1.29.6; from 1.30.0 through 1.30.2

References

https://github.com/kubernetes/kubernetes/issues/128885
https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko
http://www.openwall.com/lists/oss-security/2024/11/20/1

Get alerted when CVE-2024-10220 or the next vulnerability affects your stack