/
DirectorySecurity AdvisoriesPricing
Sign In
Security Advisories

CVE-2022-24877

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-24877

Severity

Unknown

Description

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate kustomization.yaml files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.

References

  • https://images.chainguard.dev/security/CGA-p8v9-qhp5-57fj

Affected packages


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Products

Chainguard ContainersChainguard LibrariesChainguard VMs