CVE-2025-24884: kube-audit-rest's example logging configuration could disclose secret values in the audit log
Vulnerability summary
CVE-2025-24884 is a medium (CVSS 5.1) vulnerability in richardoc kube-audit-rest. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 9.2% of scored vulnerabilities.
Not severe (CVSS 5.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 29-01-2025PublishedVulnerability first disclosed.
- 31-01-2025Last modifiedVulnerability information updated.
Description
kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST5.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.20% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
Affected systems
Known conditions: local access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/RichardoC1 product
- kube-audit-rest< 0.0.0-20250205113217-9df8886b4819 | < 0.0.0-20250129191722-db1aa5b86725
Richardoc1 product
- kube-audit-rest< 1.0.16
2 vendors · 2 products
References
5 links- github.com/RichardoC/kube-audit-rest/security/advisories/GHSA-hcr5-wv4p-h2g2X Refsource CONFIRMWEBAdvisory
- github.com/RichardoC/kube-audit-rest/commit/db1aa5b867256b0a7bf206544c6981ab068b73dcX Refsource MISCWEBFIX
