CVE-2018-1002105: Privilege Escalation in Kubernetes
Summary
CVE-2018-1002105: Privilege Escalation in Kubernetes. Affects github.com/kubernetes/kubernetes across 3 version ranges.
< 1.10.11
>= 1.11.0, < 1.11.5
>= 1.12.0, < 1.12.3
Fixed in 1.10.11, 1.11.5 or 1.12.3, depending on the release line you run. How to fix ↓
Also tracked for
- kubernetes · Debian:11
The same CVE-2018-1002105 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications. It is widely used in cloud-native environments to streamline the deployment and management of applications across clusters of machines. The vulnerability identified as CVE-2018-1002105 affects versions of Kubernetes prior to v1.10.11, v1.11.5, and v1.12.3. This vulnerability allows specially crafted requests to establish a connection through the Kubernetes API server to backend servers, enabling the execution of arbitrary requests with the Kubernetes API server's TLS credentials.
Vulnerability Detail
The vulnerability arises from the incorrect handling of error responses to proxied upgrade requests in the kube-apiserver component of Kubernetes. By exploiting this flaw, an attacker can establish a connection to backend servers through the Kubernetes API server and send arbitrary requests directly to the backend, authenticated with the Kubernetes API server's TLS credentials. This privilege escalation vulnerability can lead to unauthorized access, data breaches, and potential control over the Kubernetes cluster.
How To Fix
Latest published version: v1.14.10 as of 23 Oct 2026
go get github.com/kubernetes/kubernetes@v1.14.10Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.10.111.10.11go get github.com/kubernetes/kubernetes@v1.10.11 -
>= 1.11.0, < 1.11.51.11.5go get github.com/kubernetes/kubernetes@v1.11.5 -
>= 1.12.0, < 1.12.31.12.3go get github.com/kubernetes/kubernetes@v1.12.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can apply network policies to restrict access to the Kubernetes API server from untrusted sources. Additionally, monitoring and auditing network traffic can help detect any unauthorized connections and potential exploitation of this vulnerability.
Conclusion
The vulnerability identified as CVE-2018-1002105 in Kubernetes allows for privilege escalation and unauthorized access to backend servers through the Kubernetes API server. To mitigate this vulnerability, it is crucial to upgrade Kubernetes to the fixed versions mentioned. Applying network policies and monitoring network traffic can also provide additional protection. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/kubernetes/kubernetes →
FAQ
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications.
This vulnerability allows an attacker to establish unauthorized connections to backend servers through the Kubernetes API server, potentially leading to unauthorized access, data breaches, and control over the Kubernetes cluster.
Versions of Kubernetes prior to v1.10.11, v1.11.5, and v1.12.3 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade Kubernetes to version 1.10.11, 1.11.5, or 1.12.3, depending on the currently installed version.
As a workaround, users can apply network policies to restrict access to the Kubernetes API server from untrusted sources and monitor network traffic for any unauthorized connections.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kubernetes/kubernetes.
