| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/cubefs/cubefs | ≤ 3.2.1 | |
| cubefs | ≤ 3.2.1 |
CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free