Rita Zhang

**Name of the Vulnerable Software and Affected Versions** azure-file-csi-driver (affected versions not specified) **Description** A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when `TokenRequests` is configured in the `CSIDriver` object and the driver is set to run at log level 2 or greater via the `-v` flag. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kubernetes (affected versions not specified) **Description** The issue allows users to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. This policy ensures that pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kubernetes (affected versions not specified) **Description** The issue is related to the possibility of bypassing the ImagePolicyWebhook admission plugin's policies when using ephemeral containers in Kubernetes clusters. This could allow a remote attacker to circumvent existing security restrictions when launching containers. The vulnerability is associated with the use of the ImagePolicyWebhook admission plugin together with ephemeral containers. **Recommendations** As a temporary workaround, consider disabling the use of ephemeral containers with the ImagePolicyWebhook admission plugin until a patch is available. Restrict access to the ImagePolicyWebhook admission plugin to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.