Read the docs
TI-2017-14754 Aliases CVE-2017-1002100GHSA-rj88-p797-v9xw

Information disclosure in Kubernetes

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.

Why it matters now

EPSS 0.0133 71st percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetesv1.6.0 and later; up to v1.6.5—No fix listedCNA
  • Kubernetes VendorKubernetes Affected v1.6.0 and later; up to v1.6.5 Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.0:alpha.0:*:*:*:*:*:*1.6.0 alpha.0VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.0:alpha.1:*:*:*:*:*:*1.6.0 alpha.1VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.0:alpha.2:*:*:*:*:*:*1.6.0 alpha.2VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.0:alpha.3:*:*:*:*:*:*1.6.0 alpha.3VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.0:*:*:*:*:*:*1.6.0 beta.0VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.1:*:*:*:*:*:*1.6.0 beta.1VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.2:*:*:*:*:*:*1.6.0 beta.2VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.3:*:*:*:*:*:*1.6.0 beta.3VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.4:*:*:*:*:*:*1.6.0 beta.4VulnerableKubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:alpha.0:*:*:*:*:*:* Versions 1.6.0 alpha.0 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:alpha.1:*:*:*:*:*:* Versions 1.6.0 alpha.1 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:alpha.2:*:*:*:*:*:* Versions 1.6.0 alpha.2 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:alpha.3:*:*:*:*:*:* Versions 1.6.0 alpha.3 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.0:*:*:*:*:*:* Versions 1.6.0 beta.0 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.1:*:*:*:*:*:* Versions 1.6.0 beta.1 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.2:*:*:*:*:*:* Versions 1.6.0 beta.2 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.3:*:*:*:*:*:* Versions 1.6.0 beta.3 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:beta.4:*:*:*:*:*:* Versions 1.6.0 beta.4 Vulnerable ·Kubernetes
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:1.6.0:rc.1:*:*:*:*:*:*1.6.0 rc.1VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.1:beta.0:*:*:*:*:*:*1.6.1 beta.0VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.2:beta.0:*:*:*:*:*:*1.6.2 beta.0VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.3:*:*:*:*:*:*:*1.6.3VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.3:beta.0:*:*:*:*:*:*1.6.3 beta.0VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.3:beta.1:*:*:*:*:*:*1.6.3 beta.1VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.4:*:*:*:*:*:*:*1.6.4VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.4:beta.0:*:*:*:*:*:*1.6.4 beta.0VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.4:beta.1:*:*:*:*:*:*1.6.4 beta.1VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.5:*:*:*:*:*:*:*1.6.5VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.6.5:beta.0:*:*:*:*:*:*1.6.5 beta.0VulnerableKubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.0:rc.1:*:*:*:*:*:* Versions 1.6.0 rc.1 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.1:beta.0:*:*:*:*:*:* Versions 1.6.1 beta.0 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.2:beta.0:*:*:*:*:*:* Versions 1.6.2 beta.0 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.3:beta.0:*:*:*:*:*:* Versions 1.6.3 beta.0 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.3:beta.1:*:*:*:*:*:* Versions 1.6.3 beta.1 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.4:beta.0:*:*:*:*:*:* Versions 1.6.4 beta.0 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.4:beta.1:*:*:*:*:*:* Versions 1.6.4 beta.1 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.6.5:beta.0:*:*:*:*:*:* Versions 1.6.5 beta.0 Vulnerable ·Kubernetes

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Enterprise 3AffectedNo fix planned: Will not fix
Not affected: 1 product
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1002100
  2. 2026-10-03 Alias added: GHSA-rj88-p797-v9xw

References

Patch 2

  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
  • TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences