CVE-2024-10220
Arbitrary command execution through gitRepo volume
- Published
- Nov 22, 2024
- Updated
- Nov 25, 2024
- Assigning CNA
- kubernetes
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NLow · next 30 days
- Percentile
- 87.3%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
Sources
Proof-of-concept exploit for CVE-2024-10220, demonstrating the vulnerability and potential exploitation techniques.
CVE-2024-10220 POC
Proof-of-concept exploit for CVE-2024-10220, demonstrating the vulnerability and providing a working exploit script for security testing and validation.
- cve-2024-10220-testExploit
Kubernetes gitRepo volume vulnerability (CVE-2024-10220) exploit for controlled HPC security research, demonstrating arbitrary command execution on Kubernetes nodes.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.