CVE-2024-36539
CVE-2024-36539 is a critical-severity vulnerability in Projectcontour Contour with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-277.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- EPSS exploit prediction: 1% (66th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-36151
- Weakness: CWE-277
- Affected product: Projectcontour Contour
- Published:
- Last modified:
Description
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Frequently asked questions
- What is CVE-2024-36539?
- Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
- How severe is CVE-2024-36539?
- CVE-2024-36539 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2024-36539 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-36539?
- CVE-2024-36539 affects Projectcontour Contour. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-36539?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2024-36539 have an EU (EUVD) identifier?
- Yes. CVE-2024-36539 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-36151.
- When was CVE-2024-36539 published?
- CVE-2024-36539 was published on 2024-07-24 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:projectcontour:contour:1.28.3:*:*:*:*:kubernetes:*:*
More vulnerabilities in Projectcontour Contour
- CVE-2021-32783 — High (CVSS 8.5): Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted…
- CVE-2026-41246 — High (CVSS 8.1): Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6,…
- CVE-2023-44487 — High (CVSS 7.5): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset…
- CVE-2020-15127 — High (CVSS 7.5): In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy,…
All CVEs affecting Projectcontour Contour →
Other CWE-277 vulnerabilities
- CVE-2024-36540 — Critical (CVSS 9.8): Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by…
- CVE-2026-7891 — Critical (CVSS 9.3): The VerySecureApp made by DIVD using Mendix Studio Pro 11.8.0 Beta allows unintended data exposure due to authorization…
- CVE-2024-36542 — High (CVSS 8.8): Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the…
- CVE-2024-6605 — High (CVSS 8.8): Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This…
- CVE-2023-27842 — High (CVSS 8.8): Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to…
- CVE-2024-34329 — High (CVSS 8.4): Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch…