CVE-2022-24817

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248187.2GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can CVE-2022-248195.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to v CVE-2022-24828.8A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a CVE-2022-248205.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to v CVE-2022-248218.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/CVE-2022-248227.5Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a mod CVE-2022-248235.5Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4 CVE-2022-248245.3Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not CVE-2022-248255.3Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forge CVE-2022-248267.8On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found CVE-2022-248278.1Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: E CVE-2022-248288.8Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can h