---
id: CVE-2024-5321
aliases:
  - GHSA-82m2-cv7p-4m75
  - GO-2024-2994
title: Kubernetes sets incorrect permissions on Windows containers logs
summary: Kubernetes sets incorrect permissions on Windows containers logs
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
vendor: kubernetes
product: k8s.io/kubernetes
ecosystem: go
affected:
  - k8s.io/kubernetes < 1.27.16
  - 'k8s.io/kubernetes >= 1.28.0, < 1.28.12'
  - 'k8s.io/kubernetes >= 1.29.0, < 1.29.7'
  - 'k8s.io/kubernetes >= 1.30.0, < 1.30.3'
patched:
  - k8s.io/kubernetes 1.27.16
  - k8s.io/kubernetes 1.28.12
  - k8s.io/kubernetes 1.29.7
  - k8s.io/kubernetes 1.30.3
published: '2024-07-18'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:16.346541663Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-82m2-cv7p-4m75'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-5321'
  - url: 'https://github.com/kubernetes/kubernetes/issues/126161'
  - url: >-
      https://github.com/kubernetes/kubernetes/commit/23660a78ae462a6c8c75ac7ffd9af97550dda1aa
  - url: >-
      https://github.com/kubernetes/kubernetes/commit/84beb2915fa28ae477fe0676be8ba94ccd2b811a
  - url: >-
      https://github.com/kubernetes/kubernetes/commit/90589b8f63d28bcd3db89749950ebc48ed07c190
  - url: >-
      https://github.com/kubernetes/kubernetes/commit/de2033033b1d202ecaaa79d41861a075df8b49c1
  - url: 'https://github.com/kubernetes/kubernetes'
  - url: 'https://groups.google.com/g/kubernetes-security-announce/c/81c0BHkKNt0'
tags:
  - osv
  - go
epss: 0.00312
epssPercentile: 0.215
ingestedAt: '2026-09-12T03:13:01.765Z'
---

## Overview

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.

## Affected packages

- `k8s.io/kubernetes < 1.27.16`
- `k8s.io/kubernetes >= 1.28.0, < 1.28.12`
- `k8s.io/kubernetes >= 1.29.0, < 1.29.7`
- `k8s.io/kubernetes >= 1.30.0, < 1.30.3`

## Remediation

Upgrade to a patched release:

- `k8s.io/kubernetes 1.27.16`
- `k8s.io/kubernetes 1.28.12`
- `k8s.io/kubernetes 1.29.7`
- `k8s.io/kubernetes 1.30.3`