Detections
Analytics

SCA: security update for github.com/fluxcd/kustomize-controller (GHSA-35rf-v2jv-gfg7)

high Tenable Self-Hosted Container Security Plugin ID 409313

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for
 infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that
 can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands
 inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be
 used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an
 authenticated Kubernetes user to gain cluster admin privileges. In affected versions multitenant
 environments where non-admin users have permissions to create Flux Kustomization objects are affected by
 this issue. This vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0)
 released on 2021-10-08. Starting with v0.15, the kustomize-controller no longer executes shell commands on
 the container OS and the `kubectl` binary has been removed from the container image. To prevent the
 creation of Kubernetes Service Accounts with `secrets` in namespaces owned by tenants, a Kubernetes
 validation webhook such as Gatekeeper OPA or Kyverno can be used. (CVE-2021-41254)

See Also

https://github.com/advisories/GHSA-35rf-v2jv-gfg7

Plugin Details

Severity: High

ID: 409313

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2021-41254

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/15/2021

Vulnerability Publication Date: 11/12/2021

Reference Information

CVE: CVE-2021-41254

cwe: CWE-78