Improper privilege management in Kubernetes
Priority HIGH 84CWE-388Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 10 fixed, 1 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.
Summary
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
Why it matters now
EPSS 0.86978 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA and NVD
Fix Partial Kubernetes (Kubernetes): v1.10.11, v1.11.5, v1.12.3github.com/kubernetes/kubernetes (Go): 1.10.11, 1.11.5, 1.12.3Red Hat: 10 advisoriesRed Hat: 10 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes | v1.0.x; v1.1.x; v1.2.x; v1.3.x; v1.4.x; v1.5.x; v1.6.x; v1.7.x; v1.8.x; v1.9.x; before v1.10.11; before v1.11.5; before v1.12.3 | v1.10.11, v1.11.5, v1.12.3 | Patch available | CNA |
| — | github.com/kubernetes/kubernetes (Go) | before 1.10.11 | 1.10.11 | Patch available | GHSA-579h-mv94-g4gp |
| — | github.com/kubernetes/kubernetes (Go) | 1.11.0 to before 1.11.5 | 1.11.5 | Patch available | GHSA-579h-mv94-g4gp |
| — | github.com/kubernetes/kubernetes (Go) | 1.12.0 to before 1.12.3 | 1.12.3 | Patch available | GHSA-579h-mv94-g4gp |
- Kubernetes VendorKubernetes Affected v1.0.x; v1.1.x; v1.2.x; v1.3.x; v1.4.x; v1.5.x; v1.6.x; v1.7.x; v1.8.x; v1.9.x; before v1.10.11; before v1.11.5; before v1.12.3 Fixed in v1.10.11, v1.11.5, v1.12.3 Patch available CNA
- github.com/kubernetes/kubernetes (Go) Vendor— Affected before 1.10.11 Fixed in 1.10.11 Patch available GHSA-579h-mv94-g4gp
- github.com/kubernetes/kubernetes (Go) Vendor— Affected 1.11.0 to before 1.11.5 Fixed in 1.11.5 Patch available GHSA-579h-mv94-g4gp
- github.com/kubernetes/kubernetes (Go) Vendor— Affected 1.12.0 to before 1.12.3 Fixed in 1.12.3 Patch available GHSA-579h-mv94-g4gp
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | 1.0.0 – 1.9.11; 1.10.0 – 1.10.10; 1.11.0 – 1.11.4; 1.12.0 – 1.12.2 | Vulnerable | Kubernetes |
| cpe:2.3:a:kubernetes:kubernetes:1.9.12:beta0:*:*:*:*:*:* | 1.9.12 beta0 | Vulnerable | Kubernetes |
| cpe:2.3:a:redhat:openshift_container_platform:3.2:*:*:*:*:*:*:* | 3.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.3:*:*:*:*:*:*:* | 3.3 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.4:*:*:*:*:*:*:* | 3.4 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.6:*:*:*:*:*:*:* | 3.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.8:*:*:*:*:*:*:* | 3.8 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:* | 3.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.9.11; 1.10.0 – 1.10.10; 1.11.0 – 1.11.4; 1.12.0 – 1.12.2 Vulnerable ·Kubernetes
- cpe:2.3:a:kubernetes:kubernetes:1.9.12:beta0:*:*:*:*:*:* Versions 1.9.12 beta0 Vulnerable ·Kubernetes
- cpe:2.3:a:redhat:openshift_container_platform:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.6:*:*:*:*:*:*:* Versions 3.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.8:*:*:*:*:*:*:* Versions 3.8 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:* Versions 3.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
Remediation
- Fix · CNA Kubernetes (Kubernetes) Fixed in v1.10.11, v1.11.5, v1.12.3
- Fix · GHSA-579h-mv94-g4gp github.com/kubernetes/kubernetes (Go) Fixed in 1.10.11 Advisory →
- Fix · GHSA-579h-mv94-g4gp github.com/kubernetes/kubernetes (Go) Fixed in 1.11.5 Advisory →
- Fix · GHSA-579h-mv94-g4gp github.com/kubernetes/kubernetes (Go) Fixed in 1.12.3 Advisory →
Red Hat 10 advisories
- RHSA-2018:3624 Released 2018-12-03 · Red Hat rating CriticalOpenShift Container Platform 3.5 security update
- Red Hat OpenShift Container Platform 3.5 atomic-openshift-3.5.5.31.80-1.git.0.c4a0780.el7, atomic-openshift-clients-3.5.5.31.80-1.git.0.c4a0780.el7, atomic-openshift-clients-redistributable-3.5.5.31.80-1.git.0.c4a0780.el7 +19
- RHSA-2018:3598 Released 2018-12-03 · Red Hat rating CriticalOpenShift Container Platform 3.6 security update
- Red Hat OpenShift Container Platform 3.6 atomic-openshift-3.6.173.0.140-1.git.0.9686d52.el7, atomic-openshift-clients-3.6.173.0.140-1.git.0.9686d52.el7, atomic-openshift-clients-redistributable-3.6.173.0.140-1.git.0.9686d52.el7 +20
- RHSA-2018:3752 Released 2018-12-03 · Red Hat rating CriticalOpenShift Container Platform 3.4 security update
- Red Hat OpenShift Container Platform 3.4 atomic-openshift-3.4.1.44.57-1.git.0.a631031.el7, atomic-openshift-clients-3.4.1.44.57-1.git.0.a631031.el7, atomic-openshift-clients-redistributable-3.4.1.44.57-1.git.0.a631031.el7 +17
Show 7 more Red Hat advisories
- RHSA-2018:3754 Released 2018-12-03 · Red Hat rating CriticalOpenShift Container Platform 3.3 security update
- Red Hat OpenShift Container Platform 3.3 atomic-openshift-3.3.1.46.45-1.git.0.2ce596e.el7, atomic-openshift-clients-3.3.1.46.45-1.git.0.2ce596e.el7, atomic-openshift-clients-redistributable-3.3.1.46.45-1.git.0.2ce596e.el7 +17
- RHSA-2018:3742 Released 2018-12-03 · Red Hat rating CriticalOpenShift Container Platform 3.2 security update
- Red Hat OpenShift Container Platform 3.2 atomic-openshift-3.2.1.34-2.git.20.6367d5d.el7, atomic-openshift-clients-3.2.1.34-2.git.20.6367d5d.el7, atomic-openshift-clients-redistributable-3.2.1.34-2.git.20.6367d5d.el7 +10
- RHSA-2018:2906 Released 2018-11-21 · Red Hat rating CriticalOpenShift Container Platform 3.7 security update
- Red Hat OpenShift Container Platform 3.7 atomic-openshift-3.7.72-1.git.0.925b9cd.el7, atomic-openshift-clients-3.7.72-1.git.0.925b9cd.el7, atomic-openshift-clients-redistributable-3.7.72-1.git.0.925b9cd.el7 +21
- RHSA-2018:3549 Released 2018-11-20 · Red Hat rating CriticalOpenShift Container Platform 3.10 security update
- Red Hat OpenShift Container Platform 3.10 atomic-enterprise-service-catalog-1:3.10.72-1.git.1450.7d3f435.el7, atomic-enterprise-service-catalog-svcat-1:3.10.72-1.git.1450.7d3f435.el7, atomic-openshift-3.10.72-1.git.0.3cb2fdc.el7 +25
- RHSA-2018:2908 Released 2018-11-20 · Red Hat rating CriticalOpenShift Container Platform 3.9 security update
- Red Hat OpenShift Container Platform 3.9 atomic-openshift-3.9.51-1.git.0.dc3a40b.el7, atomic-openshift-clients-3.9.51-1.git.0.dc3a40b.el7, atomic-openshift-clients-redistributable-3.9.51-1.git.0.dc3a40b.el7 +11
- RHSA-2018:3537 Released 2018-11-20 · Red Hat rating CriticalOpenShift Container Platform 3.11 security update
- Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.43-1.git.0.647ac05.el7, atomic-openshift-clients-redistributable-3.11.43-1.git.0.647ac05.el7, atomic-openshift-docker-excluder-3.11.43-1.git.0.647ac05.el7 +11
- RHSA-2018:3551 Released 2018-11-19 · Red Hat rating CriticalOpenShift Container Platform 3.8 security update
- Red Hat OpenShift Container Platform 3.8 atomic-openshift-3.8.44-1.git.0.9be0abd.el7, atomic-openshift-clients-3.8.44-1.git.0.9be0abd.el7, atomic-openshift-clients-redistributable-3.8.44-1.git.0.9be0abd.el7 +12
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Enterprise 3.0 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.10 | Fixed | RHSA-2018:3549 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2018:3537 |
| Red Hat OpenShift Container Platform 3.2 | Fixed | RHSA-2018:3742 |
| Red Hat OpenShift Container Platform 3.3 | Fixed | RHSA-2018:3754 |
| Red Hat OpenShift Container Platform 3.4 | Fixed | RHSA-2018:3752 |
| Red Hat OpenShift Container Platform 3.5 | Fixed | RHSA-2018:3624 |
| Red Hat OpenShift Container Platform 3.6 | Fixed | RHSA-2018:3598 |
| Red Hat OpenShift Container Platform 3.7 | Fixed | RHSA-2018:2906 |
| Red Hat OpenShift Container Platform 3.8 | Fixed | RHSA-2018:3551 |
| Red Hat OpenShift Container Platform 3.9 | Fixed | RHSA-2018:2908 |
Not affected: 3 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 3.8
- Red Hat OpenShift Container Platform 3.9
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1002105
- 2026-10-03 Alias added: GHSA-579h-mv94-g4gp
References
Advisory 12
- RHSA-2018:3549
- RHSA-2018:3752
- RHSA-2018:3624
- https://www.coalfire.com/The-Coalfire-Blog/December-2018/Kubernetes-Vulnerability-What-You-Can-Should-Do
- RHSA-2018:3742
- RHSA-2018:3754
- RHSA-2018:3537
- RHSA-2018:3598
- RHSA-2018:3551
- https://security.netapp.com/advisory/ntap-20190416-0001/
- openSUSE-SU-2020:0554
- https://nvd.nist.gov/vuln/detail/CVE-2018-1002105
Other 13
- https://groups.google.com/forum/#%21topic/kubernetes-announce/GVllWCg6L88
- [oss-security] 20190628 Re: linux-distros membership application - Microsoft
- [oss-security] 20190706 Re: linux-distros membership application - Microsoft
- [oss-security] 20190706 Re: linux-distros membership application - Microsoft
- https://github.com/kubernetes/kubernetes/commit/2257c1ecbe3c0cf71dd50b82752ae189c94ec905
- https://www.openwall.com/lists/oss-security/2019/07/06/4
- https://www.openwall.com/lists/oss-security/2019/07/06/3
- https://www.openwall.com/lists/oss-security/2019/06/28/2
- https://www.exploit-db.com/exploits/46053
- https://www.exploit-db.com/exploits/46052
- https://security.netapp.com/advisory/ntap-20190416-0001
- https://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- https://groups.google.com/forum/#!topic/kubernetes-announce/GVllWCg6L88
More Kubernetes vulnerabilities
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
- TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
- TI-2019-08423 Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack CVSS 3.1HIGH 7.5
Sources
- CVE-2018-1002105 · CVE Program
- CVE-2018-1002105 · NVD
- FIRST EPSS
- GHSA-579h-mv94-g4gp · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1002105 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences