Main Vulnerability Database Vulnerabilities #VU118721

Input validation error in Kubelet - CVE-2024-9042

Published: November 24, 2025

Vulnerability identifier: #VU118721

CSH Severity: Low

CVSS v4: 7.4 [CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-9042

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to execute arbitrary commands.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host.

Affected software

Kubelet
Netcool Operations Insight

How to mitigate CVE-2024-9042

Install updates from vendor's website.

Kubelet - addressed in versions 1.29.13, 1.30.9, 1.31.5, 1.32.1
Netcool Operations Insight - update to 1.6.15

External References

https://github.com/kubernetes/kubernetes/issues/129654
https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg
http://www.openwall.com/lists/oss-security/2025/01/16/1

Related Security Bulletins