CVE-2019-11243

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-271 CWE-212

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-112445.0In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cach CVE-2019-112457.8In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container re CVE-2019-112466.5The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar ins CVE-2019-112478.1The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were na CVE-2019-112488.2The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kube CVE-2019-112496.5The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar ins CVE-2019-11255.6An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who succ CVE-2019-112506.5The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized user CVE-2019-112515.7The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlin CVE-2019-112526.5The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs CVE-2019-112537.5Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 a CVE-2019-112546.5The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sen