CVE-2023-30617: Leverage the kruise-daemon pod to list all secrets in the entire cluster
Vulnerability summary
CVE-2023-30617 is a medium (CVSS 6.5) Execution with Unnecessary Privileges vulnerability in openkruise kruise. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 42.1% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 03-01-2024PublishedVulnerability first disclosed.
- 16-06-2025Last modifiedVulnerability information updated.
Description
Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the "captured" secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.49% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/openkruise1 product
- kruise≥ 0.8.0, < 1.3.1 | ≥ 1.4.0, < 1.4.1 | ≥ 1.5.0, < 1.5.2
Openkruise1 product
- kruise= 1.4.0 | ≥ 0.8.0, < 1.3.1 | ≥ 1.4.0, < 1.4.1 | ≥ 1.5.0, < 1.5.2
2 vendors · 2 products
References
3 links- github.com/openkruise/kruise/security/advisories/GHSA-437m-7hj5-9mpwX Refsource CONFIRMWEBVendor Advisory
- github.com/openkruise/kruisePACKAGE