CVE-2024-36532

Critical

Published: 21 June 2024

Published

21 June 2024

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0013 31.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-36532 is a critical-severity Improper Preservation of Permissions (CWE-281) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-281

Forces removal or modification of permissions no longer required after reassignment, preventing improper preservation of old access rights.