CVE-2024-3177

What it actually does

The flaw permits containers, init containers, and ephemeral containers that populate the envFrom field to reference secrets outside those listed in the service account's secrets field, bypassing the ServiceAccount admission plugin's mountable-secrets enforcement when the kubernetes.io/enforce-mountable-secrets annotation is present.

Why it matters to the business

Organizations may experience unauthorized exposure of secrets used by service accounts, increasing the risk of credential leakage and downstream cluster compromise in environments that rely on this policy for isolation.

How an attack unfolds

An attacker with permissions to create or modify pods submits a manifest that uses envFrom to inject environment variables from secrets not permitted by the service account; the admission plugin fails to enforce the policy for this field combination, allowing the pod to start with the unauthorized secrets mounted.

How to fix it

Upgrade Kubernetes clusters to a version that corrects the envFrom handling in the ServiceAccount admission plugin; until patches are available, avoid combining the enforce-mountable-secrets annotation with workloads that use envFrom or migrate to explicit env references listed in the service account.

How to confirm the fix worked

Audit existing pod and workload definitions for envFrom usage against service accounts that carry the enforce-mountable-secrets annotation; re-test the admission plugin behavior after applying updates by attempting to schedule a pod that references a non-listed secret.

Typical attack path

1. Locate service accounts annotated with kubernetes.io/enforce-mountable-secrets
2. Craft a pod, init container, or ephemeral container spec that references restricted secrets via envFrom
3. Submit the pod to the API server
4. Read the injected environment variables or mounted secrets from the running container

How to detect it

Search Kubernetes audit logs for pod creation or update events that include envFrom fields on pods associated with service accounts carrying the enforce-mountable-secrets annotation; correlate with API server admission decisions and subsequent secret volume mounts or environment variable reads inside containers.

What your security team should do

• Inventory all service accounts using the enforce-mountable-secrets annotation and identify workloads that employ envFrom
• Temporarily restrict pod creation privileges or add validating admission webhooks that block envFrom in annotated namespaces
• Monitor release notes for the corrected Kubernetes versions and schedule upgrades according to internal change windows
• Review RBAC rules that allow pod creation to limit the blast radius of the bypass