Credential leakage when failing to mount
Priority LOW 31CWE-209Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-209.
Summary
The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.
Why it matters now
EPSS 0.00967 62nd percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 1 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes | 1.16; 1.17; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15 | — | No fix listed | CNA |
- Kubernetes VendorKubernetes Affected 1.16; 1.17; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | 1.0.0 – 1.17.0 | Vulnerable | Kubernetes |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.17.0 Vulnerable ·Kubernetes
Remediation
Red Hat 2 advisories
- RHSA-2020:2412 Released 2020-07-13 · Red Hat rating ModerateOpenShift Container Platform 4.5 container image security update
- Red Hat OpenShift Container Platform 4.5 openshift4/ose-cluster-logging-operator, openshift4/ose-console, openshift4/ose-hyperkube +2
- RHSA-2020:2413 Released 2020-07-13 · Red Hat rating ModerateOpenShift Container Platform 4.5 package security update
- Red Hat OpenShift Container Platform 4.5 machine-config-daemon-4.5.0-202007012112.p0.git.2527.d12c3da.el8, openshift-4.5.0-202007012112.p0.git.0.582d7fc.el7, openshift-4.5.0-202007012112.p0.git.0.582d7fc.el8 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4.5 | Fixed | RHSA-2020:2412, RHSA-2020:2413 |
Not affected: 2 products
- Red Hat OpenShift Container Platform 4.5
- Red Hat Openshift Container Storage 4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11252
References
More Kubernetes vulnerabilities
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
- TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
Sources
- CVE-2019-11252 · CVE Program
- CVE-2019-11252 · NVD
- FIRST EPSS
- CVE-2019-11252 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences