Description
This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubelet | <=v1.32.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 13 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250327T184518-1.1 | openSUSE-SU-2025:14937-1 |
| openSUSE Tumbleweed | kubernetes1.29 | 1.29.15-1.1 | openSUSE-SU-2025:14924-1 |
| openSUSE Tumbleweed | kubernetes1.30 | 1.30.11-1.1 | openSUSE-SU-2025:14925-1 |
| openSUSE Tumbleweed | kubernetes1.31 | 1.31.7-1.1 | openSUSE-SU-2025:14926-1 |
| openSUSE Tumbleweed | kubernetes1.32 | 1.32.3-1.1 | openSUSE-SU-2025:14927-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubectl-1.28 +5 | No fix yet | — |
| Wolfi rolling | kubectl-1.32 +1 | 1.32.3-r4 | — |
| Wolfi rolling | kubelet-1.34 | 1.34.9-r0 | — |
| Wolfi rolling | kubelet-1.35 | 1.35.6-r0 | — |
| Wolfi rolling | kubelet-1.36 | 1.36.2-r0 | — |
| Wolfi rolling | vcluster +2 | 0.26.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | <= 1.32.3 | — | GHSA-3wgm-2gw2-vh5m |
| Go | k8s.io/kubernetes | all versions | — | GO-2025-3521 |
Advisories 6
- openSUSE-SU-2025:14927-1 kubernetes1.32-apiserver-1.32.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14925-1 kubernetes1.30-apiserver-1.30.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14926-1 kubernetes1.31-apiserver-1.31.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14924-1 kubernetes1.29-apiserver-1.29.15-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14937-1 govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0563 Kubernetes: Schwachstelle ermöglicht Umgehung von Sicherheitsmechanismen BSI CERT-Bund (WID) · Mar 26, 2025