CVE-2024-3177

A security issue was discovered in Kubernetes where users may be able to
launch containers that bypass the mountable secrets policy enforced by the
ServiceAccount admission plugin when using containers, init containers, and
ephemeral containers with the envFrom field populated. The policy ensures
pods running with a service account may only reference secrets specified in
the service account’s secrets field. Kubernetes clusters are only affected
if the ServiceAccount admission plugin and the
kubernetes.io/enforce-mountable-secrets annotation are used together with
containers, init containers, and ephemeral containers with the envFrom
field populated.

Notes