CVE-2019-10200

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. With access to the security credentials, the user then has access to the entire infrastructure. Impact to data and system availability is high.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Mar 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10200017.5yard before 0.9.20 allows path traversal.CVE-2019-10200027.5Pterodactyl before 0.7.14 with 2FA allows credential sniffing.CVE-2019-10200035.4invenio-records before 1.2.2 allows XSS.CVE-2019-10200047.5Tridactyl before 1.16.0 allows fake key events.CVE-2019-10200055.4invenio-communities before 1.0.0a20 allows XSS.CVE-2019-10200066.1invenio-app before 1.1.1 allows host header injection.CVE-2019-10200075.4Dependency-Track before 3.5.1 allows XSS.CVE-2019-10200086.1stacktable.js before 1.0.4 allows XSS.CVE-2019-10200097.5Fleet before 2.1.2 allows exposure of SMTP credentials.CVE-2019-10200106.1Misskey before 10.102.4 allows hijacking a user's token.CVE-2019-10200117.2SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.CVE-2019-10200127.5parse-server before 3.4.1 allows DoS after any POST to a volatile class.