Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/openkruise/kruise >= 1.8.0, < 1.8.3; < 1.7.5
Fixed in
1.7.51.8.3· Vendor fix available
Issue
PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these probe configurations. Since kruise-daemon runs with hostNetwork=true, it executes probes from the node network namespace. An attacker with PodProbeMarker creation permission can specify arbitrary Host values (127.0.0.1, 169.254.169.254, internal IPs) to trigger SSRF from the node, perform port scanning, and receive response feedback through NodePodProbe status messages. Kubernetes Version - Kubernetes: v1.30.0 (kind cluster) - Distribution: kind Component Version - OpenKruise: v1.8.0 - kruise-daemon: DaemonSet with hostNetwork=true - Affected CRDs: PodProbeMarker, NodePodProbe Steps To Reproduce Environment Setup 1. Install OpenKruise v1.8.0 in kind cluster: 2. Verify kruise-daemon runs with hostNetwork: Output: 3. Create test namespace and RBAC: 4. Deploy victim workload: Exploitation Steps 5. Verify node-local port accessibility…
Recommended action: Upgrade to 1.8.3 or 1.7.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Attacker that has gain root privilege of the node that kruise-daemon run , can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, attackers can leverage the "captured" secrets (e.g. the kruise-manager service account token) to gain extra privilege such as pod modification. Workarounds For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege Patches For users who're using v0.8.x ~ v1.2.x, please update the v1.3.1 For users who're using v1.3, please update the v1.3.1 For users who're using v1.4, please update the v1.4.1 For users who're using v1.5, please update the v1.5.2 References None
Recommended action: Upgrade to 1.5.2, 1.4.1 or 1.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.