CVE-2024-10220
Arbitrary command execution through gitRepo volume
- Published
- Nov 22, 2024
- Updated
- Nov 25, 2024
- Assigning CNA
- kubernetes
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NLow · next 30 days
- Percentile
- 87.3%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
Sources
Proof-of-concept exploit for CVE-2024-10220, demonstrating the vulnerability and potential exploitation techniques.
CVE-2024-10220 POC
Proof-of-concept exploit for CVE-2024-10220, demonstrating the vulnerability and providing a working exploit script for security testing and validation.
- cve-2024-10220-testExploit
Kubernetes gitRepo volume vulnerability (CVE-2024-10220) exploit for controlled HPC security research, demonstrating arbitrary command execution on Kubernetes nodes.
CVE-2024-10220 Test repo
CVE-2024-10220 reveals a critical flaw in Kubernetes’ deprecated gitRepo volume type, allowing attackers to execute arbitrary commands via malicious .hooks scripts. The article explains how this breaks container isolation and offers exploit code, automation examples, and mitigation guidance
Exploit implementation for CVE-2024-10220 targeting a Git vulnerability. Provides a proof-of-concept shell script for testing and educational purposes.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.