GCVE - cpe:2.3:a:piraeus_operator:piraeus_operator:2.5.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:piraeus_operator:piraeus_operator:2.5.0:*:*:*:*:*:*:*

part: a version: 2.5.0 update: *

Vendor	Piraeus Operator (`214415c7-3262-5de3-a522-6ffb8e7ecda3`)
Product	Piraeus Operator (`0140bacc-9b02-511f-9126-3ff77ff5552e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-33398`	vulnerable	2026-06-08 06:37:31.092871	Details available There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the service account bound to this ClusterRole and use its high-risk privileges to list confidential information across the cluster. Published: 2024-05-03T00:00:00.000Z Updated: 2024-08-02T02:27:53.612Z Open on db.gcve.eu Reference links https://github.com/HouqiyuA/k8s-rbac-poc https://github.com/piraeusdatastore/piraeus-operator https://piraeus.io/ https://gist.github.com/HouqiyuA/d0c11fae5ba4789946ae33175d0f9edb	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.