AccessKeyID validation bypass
Priority MEDIUM 40CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.
Why it matters now
EPSS 0.01101 65th percentileScored 2026-11-07
Fix Partial aws-iam-authenticator (Kubernetes): v0.5.9sigs.k8s.io/aws-iam-authenticator (Go): 0.5.9Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | aws-iam-authenticator | v0.5.2 and later; before v0.5.9 | v0.5.9 | Patch available | CNA |
| — | sigs.k8s.io/aws-iam-authenticator (Go) | before 0.5.9 | 0.5.9 | Patch available | GHSA-pp3f-98qg-5g75 |
- aws-iam-authenticator VendorKubernetes Affected v0.5.2 and later; before v0.5.9 Fixed in v0.5.9 Patch available CNA
- sigs.k8s.io/aws-iam-authenticator (Go) Vendor— Affected before 0.5.9 Fixed in 0.5.9 Patch available GHSA-pp3f-98qg-5g75
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:aws-iam-authenticator:*:*:*:*:*:kubernetes:*:* | 0.5.2 to before 0.5.9 | Vulnerable | Kubernetes |
- cpe:2.3:a:kubernetes:aws-iam-authenticator:*:*:*:*:*:kubernetes:*:* Versions 0.5.2 to before 0.5.9 Vulnerable ·Kubernetes
Remediation
- Fix · CNA aws-iam-authenticator (Kubernetes) Fixed in v0.5.9
- Fix · GHSA-pp3f-98qg-5g75 sigs.k8s.io/aws-iam-authenticator (Go) Fixed in 0.5.9 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2385
- 2026-10-03 Alias added: GHSA-pp3f-98qg-5g75
References
Advisory 3
Other 4
- https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/469
- https://github.com/kubernetes-sigs/aws-iam-authenticator/commit/029d1dcf2ec8d662d9b1c21260bb197404bc8218
- https://github.com/kubernetes-sigs/aws-iam-authenticator
- https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v0.5.9
Sources
- CVE-2022-2385 · CVE Program
- CVE-2022-2385 · NVD
- FIRST EPSS
- GHSA-pp3f-98qg-5g75 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-2385 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences