GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2024-9779

Vulnerability from fkie_nvd - Published: 2024-12-17 23:15 - Updated: 2026-06-17 08:25
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Summary
A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named "cluster-manager", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster.
References
secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2024-9779
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2317916
secalert@redhat.comhttps://github.com/open-cluster-management-io/ocm/pull/325
secalert@redhat.comhttps://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0
secalert@redhat.comhttps://github.com/open-cluster-management-io/registration-operator/issues/361
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/open-cluster-management-io",
          "packageName": "open-cluster-management-io",
          "versions": [
            {
              "status": "affected",
              "version": "0.12.0"
            },
            {
              "status": "unaffected",
              "version": "0.13.0"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:acm:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "open-cluster-management",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
          "vendor": "Red Hat"
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name \"cluster-manager\" which is bound to a ClusterRole also named \"cluster-manager\", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager\u0027s token and steal any service account token by creating and mounting the target service account to control the whole cluster."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una falla en Open Cluster Management (OCM) cuando un usuario tiene acceso a los nodos de trabajo que contienen las implementaciones de cluster-manager o klusterlet. La implementaci\u00f3n de cluster-manager utiliza una cuenta de servicio con el mismo nombre \"cluster-manager\" que est\u00e1 vinculada a un ClusterRole tambi\u00e9n llamado \"cluster-manager\", que incluye el permiso para crear recursos de pod. Si esta implementaci\u00f3n ejecuta un pod en un nodo controlado por un atacante, este puede obtener el token de cluster-manager y robar cualquier token de cuenta de servicio mediante la creaci\u00f3n y el montaje de la cuenta de servicio de destino para controlar todo el cl\u00faster."
    }
  ],
  "id": "CVE-2024-9779",
  "lastModified": "2026-06-17T08:25:14.637",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.7,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9779",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-12-18T15:15:18.122532Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-12-17T23:15:05.603",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9779"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317916"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/open-cluster-management-io/ocm/pull/325"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/open-cluster-management-io/registration-operator/issues/361"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-266"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.