Read the docs
TI-2019-07521 Aliases CVE-2019-10200GHSA-8283-mprv-vc6w

Improper access control in OpenShift Container Platform

Priority LOW 34CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-284.

Summary

A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. With access to the security credentials, the user then has access to the entire infrastructure. Impact to data and system availability is high.

Why it matters now

EPSS 0.01254 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—OpenShift Container PlatformOpenShift Container Platform 4—No fix listedCNA
  • OpenShift Container Platform Vendor— Affected OpenShift Container Platform 4 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10200
  2. 2026-10-03 Alias added: GHSA-8283-mprv-vc6w

References

Patch 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-34021 Linux kernel skb coalescing drops shared-frag marker KEVCVSS 3.1HIGH 7.8
  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
See all 340 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences