Executive brief
Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
Affected products
- Go github.com/fluxcd/kustomize-controller
Junglewise Threat Intelligence
CVE-2021-41254: GO-2022-0260 - Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
CVE-2021-41254 · Severity: low · CVSS 3.1 · Published 2024-08-21
Technologies: github.com/fluxcd/kustomize-controller (Go). Vendors: Go.
Related threats
- GO-2022-0448 - Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2
- GO-2022-0447 - Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2
- GO-2022-1071 - Denial of service in flux controllers in github.com/fluxcd modules
- Improper kubeconfig validation allows arbitrary code execution