CVE-2024-36533

An unauthenticated attacker can gain access to a service account token due to overly permissive permissions configured in the Volcano system. The obtained token can then be used to authenticate as a privileged account and obtain greater access rights in the environment.

An attacker can gain access to sensitive data and escalate their privileges (privilege escalation), potentially taking control over resources in the environment where Volcano operates.

Patches available from the vendor should be applied according to the references. It is also recommended to review and tighten the configuration of service account permissions in environments using Volcano.

Volcano v1.8.2