CVE-2024-56514

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTP(s) URL to retrieve the custom resource definitions(CRDs) needed by Karmada. The CRDs are downloaded as a gzipped tarfile and are vulnerable to a TarSlip vulnerability. An attacker able to supply a malicious CRD file into a Karmada initialization could write arbitrary files in arbitrary paths of the filesystem. From Karmada version 1.12.0, when processing custom CRDs files, CRDs archive verification is utilized to enhance file system robustness. A workaround is available. Someone who needs to set flag `--crd` to customize the CRD files required for Karmada initialization when using `karmadactl init` to set up Karmada can manually inspect the CRD files to check whether they contain sequences such as `../` that would alter file paths, to determine if they potentially include malicious files. When using karmada-operator to set up Karmada, one must upgrade one's karmada-operator to one of the fixed versions.

• CWE-22

• https://github.com/karmada-io/karmada/commit/40ec488b18a461ab0f871d2c9ec8665b361f0d50
• https://github.com/karmada-io/karmada/commit/f78e7e2a3d02bed04e9bc7abd3ae7b3ac56862d2
• https://github.com/karmada-io/karmada/pull/5703
• https://github.com/karmada-io/karmada/pull/5713
• https://github.com/karmada-io/karmada/security/advisories/GHSA-cwrh-575j-8vr3

Published

Jan 3, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56509changedetection.io is a free open source web page change det…8.6
• CVE-2024-5651A flaw was found in the Fence Agents Remediation operator. T…8.8
• CVE-2024-56510@marp-team/marp-core is the core for Marp, which is the ecos…5.3
• CVE-2024-56511DataEase is an open source data visualization analysis tool.…9.8
• CVE-2024-56512Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained au…5.4
• CVE-2024-56513Karmada is a Kubernetes management system that allows users …8.7
• CVE-2024-56515Matrix Media Repo (MMR) is a highly configurable multi-homes…6.5
• CVE-2024-56516free-one-api allows users to access large language model rev…6.9
• CVE-2024-56517LGSL (Live Game Server List) provides online status lists fo…5.3
• CVE-2024-56518Hazelcast Management Center through 6.0 allows remote code e…9.8
• CVE-2024-56519An issue was discovered in TCPDF before 6.8.0. setSVGStyles …7.5
• CVE-2024-5652In Docker Desktop on Windows before v4.31.0 allows a user in…5.5