Skip to content
Fencer Vulns
critical 9.9

CVE-2022-24817 json

Improper kubeconfig validation allows arbitrary code execution

published 2022-05-06 4 y ago modified 2026-09-08 2 mo ago also BIT-flux-2022-24817 , BIT-kustomize-2022-24817 , EUVD-2022-5436 , GHSA-vvmq-fwmg-2gjc

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0

Patch / fix

  • go github.com/fluxcd/flux2 0.29.0
  • go github.com/fluxcd/kustomize-controller 0.23.0
  • go github.com/fluxcd/helm-controller 0.19.0
  • bitnami flux 0.29.0
  • bitnami kustomize 0.23.0
  • fluxcd flux2 0.29.0
  • fluxcd helm-controller 0.19.0
  • fluxcd kustomize-controller 0.23.0

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
OSV 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/fluxcd/flux2
>=0.1.0, <0.29.0
0.29.0
go github.com/fluxcd/kustomize-controller
>=0.1.0, <0.23.0
0.23.0
go github.com/fluxcd/helm-controller
>=0.2.0, <0.19.0
0.19.0
bitnami flux
>=0.1.0, <0.29.0
0.29.0
bitnami kustomize
>=0.1.0, <0.23.0
0.23.0

Affected products

  • fluxcd flux2

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.