Kubernetes vulnerabilities
107 CVEs and advisories name Kubernetes as an affected vendor, newest first. Follow it as a feed.
- CVE-2019-11250Kubernetes client-go logs authorization headers at debug verbosity levels
- CVE-2019-11249kubectl cp allows symlink directory traversal
- CVE-2019-11248Kubernetes kubelet exposes /debug/pprof info on healthz port
- CVE-2019-11247Kubernetes kube-apiserver allows access to custom resources via wrong scope
- CVE-2019-11246kubectl cp allows symlink directory traversal
- CVE-2019-11245kubelet-started container uid changes to root after first restart or if image is already pulled to the node
- CVE-2019-11244kubectl creates world-writeable cached schema files
- CVE-2019-11243In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials r
- CVE-2019-1002101kubectl cp path traversal
- CVE-2019-1002100In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Se
- CVE-2018-1002105In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the
- CVE-2018-1002103In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000.
- CVE-2018-1002101In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Wi
- CVE-2018-1002100In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned f
- CVE-2017-1002102In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projec
- CVE-2017-1002101In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with
- CVE-2017-1002100Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to