Read the docs
TI-2017-14755 Aliases CVE-2017-1002101GHSA-rqgw-vh6p-qf7j

Link following in Kubernetes

Priority MEDIUM 56CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.

Why it matters now

EPSS 0.13267 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Kubernetes (Kubernetes): v1.7.14, v1.8.9, v1.9.4Red Hat: 1 advisoryRed Hat: 5 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetesv1.3.x; v1.4.x; v1.5.x; v1.6.x; before v1.7.14; before v1.8.9; before v1.9.4v1.7.14, v1.8.9, v1.9.4Patch availableCNA
  • Kubernetes VendorKubernetes Affected v1.3.x; v1.4.x; v1.5.x; v1.6.x; before v1.7.14; before v1.8.9; before v1.9.4 Fixed in v1.7.14, v1.8.9, v1.9.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*1.3.0 – 1.3.10; 1.4.0 – 1.4.12; 1.5.0 – 1.5.8; 1.6.0 – 1.6.13; 1.7.0 to before 1.7.14; 1.8.0 to before 1.8.9; 1.9.0 to before 1.9.4VulnerableKubernetes
  • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions 1.3.0 – 1.3.10; 1.4.0 – 1.4.12; 1.5.0 – 1.5.8; 1.6.0 – 1.6.13; 1.7.0 to before 1.7.14; 1.8.0 to before 1.8.9; 1.9.0 to before 1.9.4 Vulnerable ·Kubernetes

Remediation

  • Fix · CNA Kubernetes (Kubernetes) Fixed in v1.7.14, v1.8.9, v1.9.4

Red Hat 1 advisory

  • RHSA-2018:0475 Released 2018-03-12 · Red Hat rating Important
    Red Hat OpenShift Container Platform security update
    • Red Hat OpenShift Container Platform 3.3 atomic-openshift-3.3.1.46.11-1.git.4.e236015.el7, atomic-openshift-clients-3.3.1.46.11-1.git.4.e236015.el7, atomic-openshift-clients-redistributable-3.3.1.46.11-1.git.4.e236015.el7 +9
    • Red Hat OpenShift Container Platform 3.4 atomic-openshift-3.4.1.44.38-1.git.4.bb8df08.el7, atomic-openshift-clients-3.4.1.44.38-1.git.4.bb8df08.el7, atomic-openshift-clients-redistributable-3.4.1.44.38-1.git.4.bb8df08.el7 +9
    • Red Hat OpenShift Container Platform 3.5 atomic-openshift-3.5.5.31.48-1.git.4.ff6153e.el7, atomic-openshift-clients-3.5.5.31.48-1.git.4.ff6153e.el7, atomic-openshift-clients-redistributable-3.5.5.31.48-1.git.4.ff6153e.el7 +9
    • Red Hat OpenShift Container Platform 3.6 atomic-openshift-3.6.173.0.96-1.git.4.e6301f8.el7, atomic-openshift-clients-3.6.173.0.96-1.git.4.e6301f8.el7, atomic-openshift-clients-redistributable-3.6.173.0.96-1.git.4.e6301f8.el7 +12
    • Red Hat OpenShift Container Platform 3.7 atomic-openshift-3.7.23-1.git.5.83efd71.el7, atomic-openshift-clients-3.7.23-1.git.5.83efd71.el7, atomic-openshift-clients-redistributable-3.7.23-1.git.5.83efd71.el7 +13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Kubernetes — RHSA-2018:0475

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2017-14756 Improper access control in KubernetesPriority LOW 33
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.3Fixed RHSA-2018:0475
Red Hat OpenShift Container Platform 3.4Fixed RHSA-2018:0475
Red Hat OpenShift Container Platform 3.5Fixed RHSA-2018:0475
Red Hat OpenShift Container Platform 3.6Fixed RHSA-2018:0475
Red Hat OpenShift Container Platform 3.7Fixed RHSA-2018:0475
Not affected: 1 product
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1002101
  2. 2026-10-03 Alias added: GHSA-rqgw-vh6p-qf7j

References

Exploit 1

Advisory 3

  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
  • TI-2019-08423 Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack CVSS 3.1HIGH 7.5
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences