3.1

CVE-2024-7598: Network restriction bypass via race condition during namespace termination

Deferred
AliasesUBUNTU-CVE-2024-7598DEBIAN-CVE-2024-7598CGA-277f-78jq-8q96
Published 20-03-2025Last modified 20-03-2025

Vulnerability summary

CVE-2024-7598 is a low (CVSS 3.1) vulnerability in kubernetes kube-apiserver. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 25% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 3.1, adjacent network); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
3.1/10
010
Low · v3.1 (CVE.org)
EPSS score
0.32%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 3
OPENSUSE-SU-2025:14937-1CGA-6F5P-J9X4-9HFVCGA-WC4M-9675-458C

Timeline

  1. 20-03-2025
    PublishedVulnerability first disclosed.
  2. 20-03-2025
    Last modifiedVulnerability information updated.

Description

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.31% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products
  • argo-cd-3.0All versions (No fix recorded)
  • argo-cd-3.0-compatAll versions (No fix recorded)
  • argo-cd-3.1All versions (No fix recorded)
  • argo-cd-3.1-compatAll versions (No fix recorded)
  • argo-cd-3.2All versions (No fix recorded)

1 vendor · 200 products · Showing 200 of 555

References

10 links