CVE-2025-24884

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-24884
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-24884.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-24884
Aliases
Downstream
Related
Published
2025-01-29T20:15:39Z
Modified
2025-10-30T20:30:13.434590Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
kube-audit-rest's example logging configuration could disclose secret values in the audit log
Details

kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.

Database specific 
{
    "cwe_ids": [
        "CWE-200",
        "CWE-212",
        "CWE-532"
    ]
}
References

Affected packages

Git / github.com/richardoc/kube-audit-rest

Affected ranges

Type
GIT
Repo
https://github.com/richardoc/kube-audit-rest
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
db1aa5b867256b0a7bf206544c6981ab068b73dc

Affected versions

0.*

0.0.0
0.0.1
0.0.2
0.0.4
0.0.5
0.0.6
0.0.7

1.*

1.0.0
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9