PT-2026-5359 · Unknown · Inspektor-Gadget
Ndaprela
+1
·
Published
2026-01-29
·
Updated
2026-04-30
·
CVE-2026-24905
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Inspektor Gadget versions prior to 0.48.1
Description
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The
ig binary includes a subcommand for image building, which utilizes a Makefile.build file. This file incorporates user-controlled data without proper escaping, leading to a command injection issue. An attacker controlling values within the buildOptions structure can execute arbitrary commands during the image building process. Exploitation could occur on the Linux host where the ig command is executed, particularly when using the --local flag, or within the build container if the flag is not used. The buildOptions structure is derived from the YAML gadget manifest provided to the ig image build command, requiring control over the build.yml file or its options to exploit the issue.Recommendations
Update to version 0.48.1 or later.
Exploit
Fix
Command Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Inspektor-Gadget