Kubernetes

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-1002103 1Kubernetes 1Minikube Nov 21, 2024 Dec 5, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make...Show more In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.Show less
CVE-2018-1002101 1Kubernetes 1Kubernetes Nov 21, 2024 Dec 5, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.
CVE-2016-7075 2Kubernetes Redhat 2Kubernetes Openshift Nov 21, 2024 Sep 10, 2018 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by u...Show more It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate.Show less
CVE-2018-1002100 1Kubernetes 1Kubernetes Nov 21, 2024 Jun 2, 2018 N/A· v4 5.5 MEDIUM· v3 3.6 LOW· v2 In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
CVE-2018-1000400 1Kubernetes 1Cri O Nov 21, 2024 May 18, 2018 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing...Show more Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9.Show less
CVE-2017-1002102 1Kubernetes 1Kubernetes Nov 21, 2024 Mar 13, 2018 N/A· v4 5.6 MEDIUM· v3 6.3 MEDIUM· v2 In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories fr...Show more In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.Show less
CVE-2017-1002101 1Kubernetes 1Kubernetes Nov 21, 2024 Mar 13, 2018 N/A· v4 9.6 CRITICAL· v3 5.5 MEDIUM· v2 In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can...Show more In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.Show less
CVE-2017-1002100 1Kubernetes 1Kubernetes May 13, 2026 Sep 14, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on...Show more Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.Show less
CVE-2015-7561 2Kubernetes Redhat 2Kubernetes Openshift May 13, 2026 Aug 7, 2017 N/A· v4 3.1 LOW· v3 3.5 LOW· v2 Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.
CVE-2017-1000056 1Kubernetes 1Kubernetes May 13, 2026 Jul 17, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.
CVE-2015-7528 2Kubernetes Redhat 2Kubernetes Openshift May 6, 2026 Apr 11, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.
CVE-2016-1906 1Kubernetes 1Kubernetes May 6, 2026 Feb 3, 2016 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
CVE-2016-1905 1Kubernetes 1Kubernetes May 6, 2026 Feb 3, 2016 N/A· v4 7.7 HIGH· v3 4.0 MEDIUM· v2 The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.

Previous 1 2 3 45