Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with ephemeral containers.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kubernetes | Kubernetes | * | 1.24.14 (including) |
| Kubernetes | Kubernetes | 1.25.0 (including) | 1.25.10 (including) |
| Kubernetes | Kubernetes | 1.26.0 (including) | 1.26.5 (including) |
| Kubernetes | Kubernetes | 1.27.0 (including) | 1.27.2 (including) |