CVE-2025-1767 GitRepo Volume Inadvertent Local Repository Access

[Vellore Rajakumar, Sri Saran Balaji]

Issue Details

A security vulnerability was discovered in Kubernetes that could allow a user with create pod permission to exploit gitRepo volumes to access local git repositories belonging to other pods on the same node.

This issue has been rated Medium (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) (score: 6.5), and assigned CVE-2025-1767.

Am I vulnerable?

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable. 

Affected Components

• kubelet

 

Affected Versions

• All versions of Kubernetes

How do I mitigate this vulnerability?

 

To mitigate this vulnerability, you must use an init container to perform git clone operation and then mount the directory into the Pod's container. An example of this approach is provided here.

Note: You can also restrict the use of gitRepo volumes in your cluster using policies such as ValidatingAdmissionPolicy or through Restricted pod security standard policy. You can use the following Common Expression Language (CEL) expression as part of a policy to reject use of gitRepo volumes: `has(object.spec.volumes) || !object.spec.volumes.exists(v, has(v.gitRepo))`

Detection

To detect whether this vulnerability has been exploited, you can use the following command to list all pods that use the in-tree gitRepo volume and clones to a .git subdirectory. 

`kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.volumes[].gitRepo.repository | test("^/")) | {name: .metadata.name, namespace: .metadata.namespace, repository: (.spec.volumes[] | select(.gitRepo) | .gitRepo.repository)}'`

If you find evidence that this vulnerability has been exploited, please contact secu...@kubernetes.io 

 

Additional Details

See Kubernetes Issue #130786 for more details.

 

Acknowledgements

This vulnerability was reported by Christophe Hauquiert.

Thank You,

Balaji on behalf of the Kubernetes Security Response Committee