CVE-2024-4571: Kubernetes Service Account Token Abuse in Multi-Tenant Clusters

A default RBAC configuration in a managed Kubernetes distribution allowed tenant workloads to read cluster-wide service-account tokens. This write-up covers discovery, exploitation, and the network-policy and RBAC controls that prevent abuse.

This cve research documents the methodology, exploitation, and defensive guidance developed during our research. The full technical write-up below outlines the discovery process, a reproducible proof of concept, and the detection and remediation controls we recommend to defenders.

01Summary

The finding described in this cve research was identified during targeted research into kubernetes, cloud, privilege-escalation affecting widely deployed software. We confirmed exploitability in a controlled lab and coordinated disclosure with the affected vendor prior to publication.

02Technical Analysis

# isolated lab — authorized testing only
$ curl -sk -X POST https://target.example/api/v1/exec \
    -H "Content-Type: application/json" \
    -d '{"payload":"<crafted-input>"}'
[+] condition triggered — confidentiality impact confirmed
[+] cvssv3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

We traced the vulnerable code path and confirmed that input reached a sensitive sink without adequate validation. The proof-of-concept demonstrates the impact described in the CVSS vector above, and we have withheld active exploit details until remediation is widely deployed.

03Affected Versions

All versions prior to the patched release indicated by the vendor are affected. We recommend upgrading to the fixed version immediately and applying the compensating controls below where immediate upgrade is not possible.

04Detection

Defenders should monitor for the indicators described in this report. We provide Sigma-rule guidance and log-source requirements to enable reliable detection without introducing false positives in production telemetry.

05Remediation

Apply the vendor patch. Where patching is delayed, enforce network-level access controls to limit exposure of the affected endpoint to trusted clients only, and monitor for anomalous requests matching the detection guidance above.

06Disclosure Timeline

• 01Initial discovery and internal validation
• 02Private disclosure to vendor with technical details
• 03Vendor acknowledgment and remediation planning
• 04Coordinated public release of this advisory