Kubernetes Secrets Store CSI Driver plugin directory traversals
Priority LOW 32CWE-24Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Why it matters now
EPSS 0.01492 74th percentileScored 2026-11-07
Fix Fixed Kubernetes Secrets Store CSI Driver (Kubernetes): v0.0.6, v0.0.10, v0.2.0github.com/hashicorp/vault-csi-provider (Go): 0.0.6+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes Secrets Store CSI Driver | Vault Plugin to before v0.0.6; Azure Plugin to before v0.0.10; GCP Plugin to before v0.2.0 | v0.0.6, v0.0.10, v0.2.0 | Patch available | CNA |
| — | github.com/hashicorp/vault-csi-provider (Go) | before 0.0.6 | 0.0.6 | Patch available | GHSA-2v35-wj4r-rcmv |
| — | github.com/Azure/secrets-store-csi-driver-provider-azure (Go) | before 0.0.10 | 0.0.10 | Patch available | GHSA-2v35-wj4r-rcmv |
| — | github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp (Go) | before 0.2.0 | 0.2.0 | Patch available | GHSA-2v35-wj4r-rcmv |
- Kubernetes Secrets Store CSI Driver VendorKubernetes Affected Vault Plugin to before v0.0.6; Azure Plugin to before v0.0.10; GCP Plugin to before v0.2.0 Fixed in v0.0.6, v0.0.10, v0.2.0 Patch available CNA
- github.com/hashicorp/vault-csi-provider (Go) Vendor— Affected before 0.0.6 Fixed in 0.0.6 Patch available GHSA-2v35-wj4r-rcmv
- github.com/Azure/secrets-store-csi-driver-provider-azure (Go) Vendor— Affected before 0.0.10 Fixed in 0.0.10 Patch available GHSA-2v35-wj4r-rcmv
- github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp (Go) Vendor— Affected before 0.2.0 Fixed in 0.2.0 Patch available GHSA-2v35-wj4r-rcmv
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:google:secret_manager_provider_for_secret_store_csi_driver:*:*:*:*:*:kubernetes:*:* | before 0.2.0 | Vulnerable | |
| cpe:2.3:a:hashicorp:vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:* | before 0.0.6 | Vulnerable | HashiCorp |
| cpe:2.3:a:microsoft:azure_key_vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:* | before 0.0.10 | Vulnerable | Microsoft |
- cpe:2.3:a:google:secret_manager_provider_for_secret_store_csi_driver:*:*:*:*:*:kubernetes:*:* Versions before 0.2.0 Vulnerable ·Google
- cpe:2.3:a:hashicorp:vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:* Versions before 0.0.6 Vulnerable ·HashiCorp
- cpe:2.3:a:microsoft:azure_key_vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:* Versions before 0.0.10 Vulnerable ·Microsoft
Remediation
- Fix · CNA Kubernetes Secrets Store CSI Driver (Kubernetes) Fixed in v0.0.6, v0.0.10, v0.2.0
- Fix · GHSA-2v35-wj4r-rcmv github.com/hashicorp/vault-csi-provider (Go) Fixed in 0.0.6 Advisory →
- Fix · GHSA-2v35-wj4r-rcmv github.com/Azure/secrets-store-csi-driver-provider-azure (Go) Fixed in 0.0.10 Advisory →
- Fix · GHSA-2v35-wj4r-rcmv github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp (Go) Fixed in 0.2.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8567
- 2026-10-03 Alias added: GHSA-2v35-wj4r-rcmv
References
Advisory 2
More Kubernetes vulnerabilities
- TI-2025-01719 ingress-nginx admission controller RCE escalation CVSS 3.1CRITICAL 9.8
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2025-00932 ingress-nginx controller - configuration injection via unsanitized mirror annotations CVSS 3.1HIGH 8.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2026-02839 ingress-nginx rewrite-target nginx configuration injection CVSS 3.1HIGH 8.8
- TI-2025-18233 ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVSS 3.1HIGH 8.8
Sources
- CVE-2020-8567 · CVE Program
- CVE-2020-8567 · NVD
- FIRST EPSS
- GHSA-2v35-wj4r-rcmv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences