Read the docs
TI-2017-14756 Aliases CVE-2017-1002102GHSA-mm7g-f2gg-cw8g

Improper access control in Kubernetes

Priority LOW 33CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

Why it matters now

EPSS 0.01101 65th percentileScored 2026-11-07
Fix Partial Kubernetes (Kubernetes): v1.7.14, v1.8.9, v1.9.4k8s.io/kubernetes (Go): 1.7.14, 1.8.9, 1.9.4Red Hat: 1 advisoryRed Hat: 5 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetesv1.3.x; v1.4.x; v1.5.x; v1.6.x; before v1.7.14; before v1.8.9; before v1.9.4v1.7.14, v1.8.9, v1.9.4Patch availableCNA
—k8s.io/kubernetes (Go)1.3.0 to before 1.7.141.7.14Patch availableGHSA-mm7g-f2gg-cw8g
—k8s.io/kubernetes (Go)1.8.0 to before 1.8.91.8.9Patch availableGHSA-mm7g-f2gg-cw8g
—k8s.io/kubernetes (Go)1.9.0 to before 1.9.41.9.4Patch availableGHSA-mm7g-f2gg-cw8g
  • Kubernetes VendorKubernetes Affected v1.3.x; v1.4.x; v1.5.x; v1.6.x; before v1.7.14; before v1.8.9; before v1.9.4 Fixed in v1.7.14, v1.8.9, v1.9.4 Patch available CNA
  • k8s.io/kubernetes (Go) Vendor— Affected 1.3.0 to before 1.7.14 Fixed in 1.7.14 Patch available GHSA-mm7g-f2gg-cw8g
  • k8s.io/kubernetes (Go) Vendor— Affected 1.8.0 to before 1.8.9 Fixed in 1.8.9 Patch available GHSA-mm7g-f2gg-cw8g
  • k8s.io/kubernetes (Go) Vendor— Affected 1.9.0 to before 1.9.4 Fixed in 1.9.4 Patch available GHSA-mm7g-f2gg-cw8g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*1.3.0 – 1.3.10; 1.4.0 – 1.4.12; 1.5.0 – 1.5.8; 1.6.0 – 1.6.13; 1.7.0 to before 1.7.14; 1.8.0 to before 1.8.9; 1.9.0 to before 1.9.4VulnerableKubernetes
  • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions 1.3.0 – 1.3.10; 1.4.0 – 1.4.12; 1.5.0 – 1.5.8; 1.6.0 – 1.6.13; 1.7.0 to before 1.7.14; 1.8.0 to before 1.8.9; 1.9.0 to before 1.9.4 Vulnerable ·Kubernetes

Remediation

  • Fix · CNA Kubernetes (Kubernetes) Fixed in v1.7.14, v1.8.9, v1.9.4
  • Fix · GHSA-mm7g-f2gg-cw8g k8s.io/kubernetes (Go) Fixed in 1.7.14 Advisory →
  • Fix · GHSA-mm7g-f2gg-cw8g k8s.io/kubernetes (Go) Fixed in 1.8.9 Advisory →
  • Fix · GHSA-mm7g-f2gg-cw8g k8s.io/kubernetes (Go) Fixed in 1.9.4 Advisory →

Red Hat 1 advisory

  • RHSA-2018:0475 Released 2018-03-12 · Red Hat rating Important
    Red Hat OpenShift Container Platform security update
    • Red Hat OpenShift Container Platform 3.3 atomic-openshift-3.3.1.46.11-1.git.4.e236015.el7, atomic-openshift-clients-3.3.1.46.11-1.git.4.e236015.el7, atomic-openshift-clients-redistributable-3.3.1.46.11-1.git.4.e236015.el7 +9
    • Red Hat OpenShift Container Platform 3.4 atomic-openshift-3.4.1.44.38-1.git.4.bb8df08.el7, atomic-openshift-clients-3.4.1.44.38-1.git.4.bb8df08.el7, atomic-openshift-clients-redistributable-3.4.1.44.38-1.git.4.bb8df08.el7 +9
    • Red Hat OpenShift Container Platform 3.5 atomic-openshift-3.5.5.31.48-1.git.4.ff6153e.el7, atomic-openshift-clients-3.5.5.31.48-1.git.4.ff6153e.el7, atomic-openshift-clients-redistributable-3.5.5.31.48-1.git.4.ff6153e.el7 +9
    • Red Hat OpenShift Container Platform 3.6 atomic-openshift-3.6.173.0.96-1.git.4.e6301f8.el7, atomic-openshift-clients-3.6.173.0.96-1.git.4.e6301f8.el7, atomic-openshift-clients-redistributable-3.6.173.0.96-1.git.4.e6301f8.el7 +12
    • Red Hat OpenShift Container Platform 3.7 atomic-openshift-3.7.23-1.git.5.83efd71.el7, atomic-openshift-clients-3.7.23-1.git.5.83efd71.el7, atomic-openshift-clients-redistributable-3.7.23-1.git.5.83efd71.el7 +13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Kubernetes — RHSA-2018:0475

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.3Fixed RHSA-2018:0475
Red Hat OpenShift Container Platform 3.4Fixed RHSA-2018:0475
Red Hat OpenShift Container Platform 3.5Fixed RHSA-2018:0475
Red Hat OpenShift Container Platform 3.6Fixed RHSA-2018:0475
Red Hat OpenShift Container Platform 3.7Fixed RHSA-2018:0475
Not affected: 1 product
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1002102
  2. 2026-10-03 Alias added: GHSA-mm7g-f2gg-cw8g

References

Advisory 3

Other 1

  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
  • TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences