[kubernetes] CVE-2025-1767: GitRepo Volume Inadvertent Local Repository Access

["Vellore Rajakumar, Sri Saran Balaji" <srajakum () amazon com>]

Issue Details

A security vulnerability was discovered in Kubernetes that could allow a user with create pod permission to exploit 
gitRepo volumes to access local git repositories belonging to other pods on the same node.

This issue has been rated Medium 
(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N>)
 (score: 6.5), and assigned CVE-2025-1767.

Am I vulnerable?

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other 
pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security 
updates upstream, any cluster still using this feature remains vulnerable.

Affected Components

  *   kubelet


Affected Versions

  *   All versions of Kubernetes

How do I mitigate this vulnerability?

To mitigate this vulnerability, you must use an init container to perform git clone operation and then mount the 
directory into the Pod's container. An example of this approach is provided 
here<https://gist.github.com/tallclair/849601a16cebeee581ef2be50c351841>.

Note: You can also restrict the use of gitRepo volumes in your cluster using policies such as ValidatingAdmissionPolicy 
or through Restricted pod security standard policy. You can use the following Common Expression Language (CEL) 
expression as part of a policy to reject use of gitRepo volumes: `has(object.spec.volumes) || 
!object.spec.volumes.exists(v, has(v.gitRepo))`

Detection
To detect whether this vulnerability has been exploited, you can use the following command to list all pods that use 
the in-tree gitRepo volume and clones to a .git subdirectory.

`kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.volumes[].gitRepo.repository | test("^/")) | 
{name: .metadata.name, namespace: .metadata.namespace, repository: (.spec.volumes[] | select(.gitRepo) | 
.gitRepo.repository)}'`

If you find evidence that this vulnerability has been exploited, please contact security () kubernetes 
io<mailto:security () kubernetes io>

Additional Details
See Kubernetes Issue #130786<https://github.com/kubernetes/kubernetes/pull/130786> for more details.

Acknowledgements
This vulnerability was reported by Christophe Hauquiert.

Thank You,

Balaji on behalf of the Kubernetes Security Response Committee