CVE-2018-1002101: Arbitrary Command Injection in k8s.io/kubernetes/pkg/util/mount
Summary
CVE-2018-1002101: Kubernetes Arbitrary Command Injection. Affects k8s.io/kubernetes across 3 version ranges.
>= 1.9.0, < 1.9.10
>= 1.10.0, < 1.10.6
>= 1.11.0, < 1.11.2
Fixed in 1.9.10, 1.10.6 or 1.11.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The k8s.io/kubernetes/pkg/util/mount package is a Go package used in Kubernetes for setting up volume mounts on Windows nodes. It provides functionality for handling user input and executing commands related to volume mounts. However, versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1 of this package have a vulnerability that allows for arbitrary command injection.
Vulnerability Detail
The vulnerability in the k8s.io/kubernetes/pkg/util/mount package arises from insecure handling of user input during the setup of volume mounts on Windows nodes. This insecure handling can lead to command line argument injection. An attacker can exploit this vulnerability by providing malicious input that gets executed as a command, potentially leading to unauthorized access, data leakage, or other malicious activities.
How To Fix
Latest published version: v1.37.1 as of 23 Oct 2026
go get k8s.io/kubernetes@v1.37.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.9.0, < 1.9.101.9.10go get k8s.io/kubernetes@v1.9.10 -
>= 1.10.0, < 1.10.61.10.6go get k8s.io/kubernetes@v1.10.6 -
>= 1.11.0, < 1.11.21.11.2go get k8s.io/kubernetes@v1.11.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to update to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The k8s.io/kubernetes/pkg/util/mount package in Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1 has a vulnerability that allows for arbitrary command injection. This vulnerability can be mitigated by updating to the fixed versions mentioned in the 'how_to_fix' section. It is important to apply these fixes to prevent potential unauthorized access, data leakage, or other malicious activities. For further support, you can contact DevNack.com.
See every vulnerability recorded for k8s.io/kubernetes →
FAQ
This vulnerability can allow an attacker to execute arbitrary commands on the affected system, potentially leading to unauthorized access, data leakage, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
There are no known public exploits available for this vulnerability at the time of writing. However, it is important to apply the recommended fixes to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over the network. It is important to update to the fixed versions to mitigate the risk of remote exploitation.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for k8s.io/kubernetes.
