CVE-2024-36532

CRITICAL

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

CVSS 3.110.0
EPSS0.5%
Percentile38th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-281: CWE-281
◆ AI Analysis — automated analysis, not human-reviewed

Insecure permissions in kruise v1.6.2 allow attackers to access sensitive data and escalate privileges by obtaining the service account's token.

BSID: BS-2024-GLOBAL-195959-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-36532?
Insecure permissions in kruise v1.6.2 allow attackers to access sensitive data and escalate privileges by obtaining the service account's token.
What is the CVSS score for CVE-2024-36532?
CVE-2024-36532 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 0.5%.
Is CVE-2024-36532 actively exploited?
No confirmed active exploitation of CVE-2024-36532 as of 2026-05-30.
How do I remediate CVE-2024-36532?
Priority: IMMEDIATE.
Vulnerability Details
CVE IDCVE-2024-36532
BSIDBS-2024-GLOBAL-195959-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2024-06-21
Last Modified2026-04-15
ICS Relevance0%
Weakness (CWE)
CWE-281
SourceNVD
Official Description

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability stems from improper permission settings that permit unauthorized access to a service account's token, enabling attackers to exploit this to gain elevated privileges within the Kubernetes cluster.

Exploitation Likelihood: CRITICAL

Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 846 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashc9c4083fd5c3d42dd744cf5e00f10f3e826632a1d653e1c7ec3efa07b62726c9d3f85b7b5ff11edbc921e6bdec77f0a7b450ef64bbc0d884d58d2c10b5f2a8c0

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →