Cross-site request forgery in Kubernetes Minikube
Priority LOW 39CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.
Summary
In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.
Why it matters now
EPSS 0.00702 53rd percentileScored 2026-11-07
Fix Fixed Minikube (Kubernetes): v0.30.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Minikube | v0.3.0 and later; before v0.30.0 | v0.30.0 | Patch available | CNA |
| — | k8s.io/minikube (Go) | 0.3.0 – 0.29.0 | — | No fix listed | GHSA-6pcv-qqx4-mxm3 |
- Minikube VendorKubernetes Affected v0.3.0 and later; before v0.30.0 Fixed in v0.30.0 Patch available CNA
- k8s.io/minikube (Go) Vendor— Affected 0.3.0 – 0.29.0 Fixed in — No fix listed GHSA-6pcv-qqx4-mxm3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:minikube:*:*:*:*:*:*:*:* | 0.3.0 – 0.29.0 | Vulnerable | Kubernetes |
- cpe:2.3:a:kubernetes:minikube:*:*:*:*:*:*:*:* Versions 0.3.0 – 0.29.0 Vulnerable ·Kubernetes
Remediation
- Fix · CNA Minikube (Kubernetes) Fixed in v0.30.0
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1002103
- 2026-10-03 Alias added: GHSA-6pcv-qqx4-mxm3
References
More Kubernetes Minikube vulnerabilities
- TI-2023-01110 [minikube] Network Port exposure in minikube running on macOS using Docker driver CVSS 3.1CRITICAL 9.8
- TI-2023-01827 [minikube] ssh server with default password CVSS 3.1HIGH 8.4
Sources
- CVE-2018-1002103 · CVE Program
- CVE-2018-1002103 · NVD
- FIRST EPSS
- GHSA-6pcv-qqx4-mxm3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences