Read the docs
TI-2019-08420 Aliases CVE-2019-11250GHSA-jmrx-5g74-6v2f

Kubernetes client-go logs authorization headers at debug verbosity levels

Priority LOW 32CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

Why it matters now

EPSS 0.01766 78th percentileScored 2026-11-07
Fix Partial Kubernetes (Kubernetes): 1.16k8s.io/client-go (Go): 0.17.0+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetesbefore 1.161.16Patch availableCNA
—k8s.io/client-go (Go)before 0.17.00.17.0Patch availableGHSA-jmrx-5g74-6v2f
—k8s.io/kubernetes (Go)before 1.16.0-beta.11.16.0-beta.1Patch availableGHSA-jmrx-5g74-6v2f
  • Kubernetes VendorKubernetes Affected before 1.16 Fixed in 1.16 Patch available CNA
  • k8s.io/client-go (Go) Vendor— Affected before 0.17.0 Fixed in 0.17.0 Patch available GHSA-jmrx-5g74-6v2f
  • k8s.io/kubernetes (Go) Vendor— Affected before 1.16.0-beta.1 Fixed in 1.16.0-beta.1 Patch available GHSA-jmrx-5g74-6v2f

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*before 1.15.3VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.15.3:-:*:*:*:*:*:*1.15.3VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.15.4:beta0:*:*:*:*:*:*1.15.4 beta0VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.16.0:alpha1:*:*:*:*:*:*1.16.0 alpha1VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.16.0:alpha2:*:*:*:*:*:*1.16.0 alpha2VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.16.0:alpha3:*:*:*:*:*:*1.16.0 alpha3VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.16.0:beta1:*:*:*:*:*:*1.16.0 beta1VulnerableKubernetes
cpe:2.3:a:kubernetes:kubernetes:1.16.0:beta2:*:*:*:*:*:*1.16.0 beta2VulnerableKubernetes
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*4.1VulnerableRed Hat
  • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions before 1.15.3 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.15.3:-:*:*:*:*:*:* Versions 1.15.3 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.15.4:beta0:*:*:*:*:*:* Versions 1.15.4 beta0 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.16.0:alpha1:*:*:*:*:*:* Versions 1.16.0 alpha1 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.16.0:alpha2:*:*:*:*:*:* Versions 1.16.0 alpha2 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.16.0:alpha3:*:*:*:*:*:* Versions 1.16.0 alpha3 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.16.0:beta1:*:*:*:*:*:* Versions 1.16.0 beta1 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:kubernetes:1.16.0:beta2:*:*:*:*:*:* Versions 1.16.0 beta2 Vulnerable ·Kubernetes
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat

Remediation

  • Fix · CNA Kubernetes (Kubernetes) Fixed in 1.16
  • Fix · GHSA-jmrx-5g74-6v2f k8s.io/client-go (Go) Fixed in 0.17.0 Advisory →
  • Fix · GHSA-jmrx-5g74-6v2f k8s.io/kubernetes (Go) Fixed in 1.16.0-beta.1 Advisory →

Red Hat 2 advisories

  • RHSA-2019:4087 Released 2019-12-17 · Red Hat rating Moderate
    OpenShift Container Platform 4.1 openshift security update
    • Red Hat OpenShift Container Platform 4.1 openshift-4.1.27-201912021146.git.0.a40116f.el7, openshift-4.1.27-201912021146.git.0.a40116f.el8_0, openshift-clients-4.1.27-201912021146.git.0.a40116f.el7 +5
  • RHSA-2019:4052 Released 2019-12-16 · Red Hat rating Moderate
    OpenShift Container Platform 3.11 atomic-openshift security update
    • Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.157-1.git.0.dfe38da.el7, atomic-openshift-clients-3.11.157-1.git.0.dfe38da.el7, atomic-openshift-clients-redistributable-3.11.157-1.git.0.dfe38da.el7 +10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.10AffectedNo fix yet
Red Hat OpenShift Container Platform 3.9AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2019:4052
Red Hat OpenShift Container Platform 4.1Fixed RHSA-2019:4087
Not affected: 1 product
  • Red Hat Edge Manager preview

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11250
  2. 2026-10-03 Alias added: GHSA-jmrx-5g74-6v2f

References

Advisory 5

Other 6

  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
  • TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences