CVE-2024-9042

MEDIUM

Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2024-9042 has a selected CVSS score of 5.9 (medium).

Description

This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 13, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Kubelet

Browse Kubernetes / Kubelet

Default status: unaffected

CVE List<=v1.29.12affected
v1.30 to ≤ v1.30.8affected
v1.31 to ≤ v1.31.4affected
v1.32 to ≤ v1.32.0affected

k8s.io/kubernetes

Browse Go / k8s.io/kubernetes
GitHub AdvisoryBefore 1.29.13 · Fixed in 1.29.13affected
1.30.0-alpha.0 to < 1.30.9 · Fixed in 1.30.9affected
1.31.0-alpha.0 to < 1.31.5 · Fixed in 1.31.5affected
1.32.0-alpha.0 to < 1.32.1 · Fixed in 1.32.1affected

References

9