Kubernetes Java client libraries unvalidated path traversal in Copy implementation
Priority MEDIUM 46CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
Why it matters now
EPSS 0.03688 89th percentileScored 2026-11-07
Fix Fixed Kubernetes Java Client (Kubernetes): 9.0.2, 10.0.1io.kubernetes:client-java (Maven): 9.0.2, 10.0.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes Java Client | before 9.0; 9.0 to before 9.0.2; 10.0 to before 10.0.1 | 9.0.2, 10.0.1 | Patch available | CNA |
| — | io.kubernetes:client-java (Maven) | before 9.0.2 | 9.0.2 | Patch available | GHSA-cghx-9gcr-r42x |
| — | io.kubernetes:client-java (Maven) | 10.0.0 to before 10.0.1 | 10.0.1 | Patch available | GHSA-cghx-9gcr-r42x |
- Kubernetes Java Client VendorKubernetes Affected before 9.0; 9.0 to before 9.0.2; 10.0 to before 10.0.1 Fixed in 9.0.2, 10.0.1 Patch available CNA
- io.kubernetes:client-java (Maven) Vendor— Affected before 9.0.2 Fixed in 9.0.2 Patch available GHSA-cghx-9gcr-r42x
- io.kubernetes:client-java (Maven) Vendor— Affected 10.0.0 to before 10.0.1 Fixed in 10.0.1 Patch available GHSA-cghx-9gcr-r42x
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:java:*:*:*:*:*:*:*:* | before 9.0.2; 10.0.0 to before 10.0.1 | Vulnerable | Kubernetes |
- cpe:2.3:a:kubernetes:java:*:*:*:*:*:*:*:* Versions before 9.0.2; 10.0.0 to before 10.0.1 Vulnerable ·Kubernetes
Remediation
- Fix · CNA Kubernetes Java Client (Kubernetes) Fixed in 9.0.2, 10.0.1
- Fix · GHSA-cghx-9gcr-r42x io.kubernetes:client-java (Maven) Fixed in 9.0.2 Advisory →
- Fix · GHSA-cghx-9gcr-r42x io.kubernetes:client-java (Maven) Fixed in 10.0.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Decision Manager 7
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat JBoss Fuse 6
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8570
- 2026-10-03 Alias added: GHSA-cghx-9gcr-r42x
References
Advisory 2
Other 11
- [druid-commits] 20210201 [GitHub] [druid] jon-wei opened a new pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554
- [druid-commits] 20210202 [GitHub] [druid] jon-wei opened a new pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554
- [druid-commits] 20210203 [GitHub] [druid] jihoonson commented on pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554
- [druid-commits] 20210203 [GitHub] [druid] jihoonson merged pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554
- https://github.com/kubernetes-client/java/pull/1450
- https://github.com/kubernetes-client/java/commit/858316ae8bc1145005a0310e1f65f95d2389a589
- https://github.com/kubernetes-client/java
- https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6@%3Ccommits.druid.apache.org%3E
More Kubernetes Java vulnerabilities
- TI-2021-07830 Code exec via yaml parsing CVSS 3.1MEDIUM 6.7
Sources
- CVE-2020-8570 · CVE Program
- CVE-2020-8570 · NVD
- FIRST EPSS
- GHSA-cghx-9gcr-r42x · GitHub Advisory Database · CC BY 4.0
- CVE-2020-8570 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences