Impact

This ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.

Patches

=v0.18.0

References

Reporting by @younaman(Nanzi Yang)
kubean-io/kubean#1326

References

• GHSA-3wfj-3x8q-hrpg
• kubean-io/kubean#1326
• kubean-io/kubean@167e973
• https://nvd.nist.gov/vuln/detail/CVE-2024-41820
• https://pkg.go.dev/vuln/GO-2024-3039