Vulnerability · Published Jan 16, 2025 · Assigned by Octopus
CVE-2024-12226
Medium 6.5
In plain English
A medium-severity sensitive data in logs in Kubernetes Worker or Kubernetes Agent from Octopus Deploy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 70.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions accordingly.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Octopus Deploy | Kubernetes Worker or Kubernetes Agent | 1.x – before 1.19.02.x – before 2.8.0 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N