{"id":"CVE-2024-43403","summary":"Kanister has a potential risk which can be leveraged to make a cluster-level privilege escalation","details":"Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole called edit via ClusterRoleBinding. The \"edit\" ClusterRole is one of Kubernetes default-created ClusterRole, and it has the create/patch/udpate verbs of daemonset resources, create verb of serviceaccount/token resources, and impersonate verb of serviceaccounts resources. A malicious user can leverage access the worker node which has this component to make a cluster-level privilege escalation.","aliases":["GHSA-h27c-6xm3-mcqp","GO-2024-3080"],"modified":"2026-08-12T03:51:43.779795773Z","published":"2024-08-20T21:16:41.049Z","database_specific":{"cwe_ids":["CWE-269"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43403.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/kanisterio/kanister/blob/master/helm/kanister-operator/templates/rbac.yaml#L49"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43403.json"},{"type":"ADVISORY","url":"https://github.com/kanisterio/kanister/security/advisories/GHSA-h27c-6xm3-mcqp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43403"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kanisterio/kanister","events":[{"introduced":"0"},{"last_affected":"fffef729e348ce0cf8bba3646303460d5e37fe16"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"0.110.0"}]}}],"versions":["0.110.0","0.109.0","0.108.0","0.107.0","0.106.0","0.105.0","0.104.0","0.103.0","0.102.0","0.101.0","0.100.0","0.99.0","0.98.0","0.97.0","0.96.0","0.95.0","0.94.0","0.93.0","0.92.0","0.91.0","0.90.0","0.89.0","0.88.0","0.87.0","0.86.0","0.85.0","0.84.0","0.83.0","0.82.0","0.81.0","0.80.0","0.79.0","0.78.0","0.77.0","0.76.0","0.75.0","0.74.0","0.73.0","0.72.0","0.71.0","0.70.0","0.69.0","0.68.0","0.67.0","0.66.0","0.65.0","0.64.0","0.63.0","0.61.0","0.60.0","0.59.0","0.58.0","0.57.0","0.53.0","0.51.0","0.50.0","0.49.0","0.48.0","0.45.0","0.44.0","0.43.0","0.42.0","0.41.0","0.40.0","0.39.0","0.38.0","0.37.0","0.36.0","0.35.0","0.34.0","0.33.0","0.32.0","0.31.0","0.30.0","0.29.0","0.28.0","0.27.0","0.26.0","0.25.0","0.24.0","0.23.0","0.22.0","0.21.0","0.20.0","0.19.0","0.18.0","0.17.0","0.16.0","0.15.0","0.14.0","0.13.0","0.12.0","0.11.0","0.10.0","0.9.0","0.8.0","0.7.0","0.6.0","0.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43403.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}