{"id":"CVE-2022-24817","aliases":["BIT-flux-2022-24817","BIT-kustomize-2022-24817","GHSA-vvmq-fwmg-2gjc"],"url":"https://o3.security/vulnerability/CVE-2022-24817","summary":"Improper kubeconfig validation allows arbitrary code execution","details":"Flux2 can reconcile the state of a remote cluster when provided with a [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#file-references) with the correct access rights. `Kubeconfig` files can define [commands](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target cluster, could craft a `kubeconfig` to execute arbitrary code inside the controller’s container.\n\nIn multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions.\n\n### Impact\n\nWithin the affected versions range, one of the permissions set below would be required for the vulnerability to be exploited:\n- Direct access to the cluster to create Flux `Kustomization` or `HelmRelease` objects and Kubernetes Secrets.\n- Direct access to the cluster to modify existing Kubernetes secrets being used as `kubeconfig` in existing Flux `Kustomization` or `HelmRelease` objects.\n- Direct access to the cluster to modify existing Flux `Kustomization` or `HelmRelease` objects and access to create or modify existing Kubernetes secrets.\n- Access rights to make changes to a configured Flux Source (i.e. Git repository).\n\n### Patches\n\nThis vulnerability was fixed in kustomize-controller [v0.23.0](https://github.com/fluxcd/kustomize-controller/releases/tag/v0.23.0) and helm-controller [v0.19.0](https://github.com/fluxcd/helm-controller/releases/tag/v0.19.0), both included in flux2 [v0.29.0](https://github.com/fluxcd/flux2/releases/tag/v0.29.0). Starting from the fixed versions, both controllers disable the use of command execution from `kubeconfig` files by default, users have to opt-in by adding the flag `--insecure-kubeconfig-exec` to the controller’s command arguments. Users are no longer allowed to refer to files in the controller’s filesystem in the `kubeconfig` files provided for the remote apply feature.\n\n### Workarounds\n\n- The functionality can be disabled via Validating Admission webhooks (e.g. OPA Gatekeeper, Kyverno) by restricting users from being able to set the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects.\n- Applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed.\n\n### Credits\n\nThe Flux engineering team found and patched this vulnerability.\n\n### For more information\n\nIf you have any questions or comments about this advisory please open an issue in the [flux2 repository](http://github.com/fluxcd/flux2).\n","published":"2022-05-06T00:00:14Z","modified":"2026-08-12T03:51:08.639827417Z","cvss":{"score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":{"score":0.01075,"percentile":0.61971,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/fluxcd/flux2","fixedVersion":"0.29.0"},{"ecosystem":"Go","name":"github.com/fluxcd/kustomize-controller","fixedVersion":"0.23.0"},{"ecosystem":"Go","name":"github.com/fluxcd/helm-controller","fixedVersion":"0.19.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24817.json"},{"type":"ADVISORY","url":"https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24817"},{"type":"PACKAGE","url":"https://github.com/fluxcd/flux2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:08.639827417Z"}}