Information disclosure in Red Hat kube-state-metrics
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | kube-state-metrics | kube-state-metrics versions v1.7.0 and v1.7.1 | — | No fix listed | CNA |
| — | k8s.io/kube-state-metrics (Go) | 1.7.0 to before 1.7.2 | 1.7.2 | Patch available | GHSA-c92w-72c5-9x59 |
- kube-state-metrics VendorRed Hat Affected kube-state-metrics versions v1.7.0 and v1.7.1 Fixed in — No fix listed CNA
- k8s.io/kube-state-metrics (Go) Vendor— Affected 1.7.0 to before 1.7.2 Fixed in 1.7.2 Patch available GHSA-c92w-72c5-9x59
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kube-state-metrics:1.7.0:*:*:*:*:*:*:* | 1.7.0 | Vulnerable | Kubernetes |
| cpe:2.3:a:kubernetes:kube-state-metrics:1.7.1:*:*:*:*:*:*:* | 1.7.1 | Vulnerable | Kubernetes |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | Red Hat |
- cpe:2.3:a:kubernetes:kube-state-metrics:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Kubernetes
- cpe:2.3:a:kubernetes:kube-state-metrics:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Kubernetes
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-c92w-72c5-9x59 k8s.io/kube-state-metrics (Go) Fixed in 1.7.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10223
- 2026-10-03 Alias added: GHSA-c92w-72c5-9x59
References
Advisory 2
Other 5
- [oss-security] 20190815 Re: [ANNOUNCE] Security release of kube-state-metrics v1.7.2
- https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
- https://github.com/kubernetes/kube-state-metrics/commit/03122fe3e2df49a9a7298b8af921d3c37c430f7f
- https://github.com/kubernetes/kube-state-metrics
- https://pkg.go.dev/vuln/GO-2022-0621
More Red Hat Openshift Container Platform vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-34021 Linux kernel skb coalescing drops shared-frag marker KEVCVSS 3.1HIGH 7.8
- TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2019-10223 · CVE Program
- CVE-2019-10223 · NVD
- FIRST EPSS
- GHSA-c92w-72c5-9x59 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10223 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences