CVE-2025-1767

Published Mar 13, 2025

Last updated 9 days ago

CVSS medium 6.5
Kubernetes

Overview

Description
This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.
Source
jordan@liggitt.net
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
6.5
Impact score
5.2
Exploitability score
1.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Severity
MEDIUM

Weaknesses

jordan@liggitt.net
CWE-20

Social media

Hype score
Not currently trending

  1. #CVE-2025-1767 : le volume gitRepo Kubernetes permet l'escalade via les pods d'un même nœud. Fonctionnalité dépréciée, zéro correctif prévu upstream. Si vous l'utilisez encore, vous êtes exposés définitivement. Migrez vers des init containers ou des solutions CSI.

    @doctorkloud

    10 Mar 2026

    90 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. This post analyzes CVE-2025-1767, a Kubernetes vulnerability where gitRepo volumes let pods clone any host-local Git repo if the attacker knows the path ➤ https://t.co/uoUUzBag8B

    @kubesploit

    24 Jul 2025

    231 Impressions

    0 Retweets

    0 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  3. This post analyzes CVE-2025-1767, a Kubernetes vulnerability where gitRepo volumes let pods clone any host-local Git repo if the attacker knows the path ➜ https://t.co/uoUUzBag8B

    @kubesploit

    24 Jun 2025

    230 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  4. CVE-2025-1767 - Another gitrepo issue https://t.co/CwEN4NlRPq #kubernetes #k8s #gitrepo

    @jvela

    30 Mar 2025

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. Kubernetes CVE-2025-1767 TLDR; It's highly unlikely you need to worry about this. The prereqs: - Cluster Access - Knowledge of the path of a local Git repository used by another pod on the same node - Create pod permissions on the node https://t.co/eE3aR8h7rB

    @GrahamHelton3

    14 Mar 2025

    1697 Impressions

    0 Retweets

    12 Likes

    6 Bookmarks

    2 Replies

    0 Quotes

  6. CVE-2025-1767 - Another gitrepo issue https://t.co/oPvNSSgys7

    @Dinosn

    14 Mar 2025

    118 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 🚨 CVE-2024-9042 🟠 MEDIUM (5.9) 🏢 Kubernetes - Kubelet 🏗️ <=v1.29.12 🔗 https://t.co/s8rb7blQx2 🔗 https://t.co/RWSAxwkpRO 🚨 CVE-2025-1767 🟠 MEDIUM (6.5) 🏢 Kubernetes - Kubelet 🏗️ <=v1.32.2 🔗 https://t.co/fdCJdY5xAl 🔗 https://t.co/pmz96tY8ia https://t.co/FCNJ8rT55

    @gothburz

    14 Mar 2025

    78 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  8. CVE-2025-1767 This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitR… https://t.co/4GKXLMDwSP

    @CVEnew

    13 Mar 2025

    189 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)•CVE-2025-15566
  2. A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.•CVE-2025-4563
  3. A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)•CVE-2025-24514
  4. A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)•CVE-2025-1098
  5. A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)•CVE-2025-1974

References

Sources include official advisories and independent security research.