CVE-2024-3744

A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.

• CWE-532

• http://www.openwall.com/lists/oss-security/2024/05/09/4
• https://github.com/kubernetes/kubernetes/issues/124759
• https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ
• http://www.openwall.com/lists/oss-security/2024/05/09/4
• https://github.com/kubernetes/kubernetes/issues/124759
• https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ

Published

May 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37434Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2024-37435Cross-Site Request Forgery (CSRF) vulnerability in raratheme…8.8
• CVE-2024-37436Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-37437Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-37438Cross-Site Request Forgery (CSRF) vulnerability in Uncanny O…5.4
• CVE-2024-37439Missing Authorization vulnerability in Uncanny Owl Uncanny T…5.4
• CVE-2024-37440Missing Authorization vulnerability in andy_moyle Church Adm…4.3
• CVE-2024-37441Cross-Site Request Forgery (CSRF) vulnerability in desertthe…4.3
• CVE-2024-37442Improper Neutralization of Special Elements in Output Used b…5.5
• CVE-2024-37443Missing Authorization vulnerability in Automattic WP Job Man…4.3
• CVE-2024-37444Missing Authorization vulnerability in WPMU DEV - Your All-i…9.8
• CVE-2024-37445Improper Neutralization of Input During Web Page Generation …5.4