CVE-2020-8568: Directory Traversal in Kubernetes Secrets Store CSI Driver
Summary
CVE-2020-8568: Directory traversal in Kubernetes Secrets Store CSI Driver. Affects sigs.k8s.io/secrets-store-csi-driver versions >= 0.0.15, < 0.0.17. Fixed in 0.0.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kubernetes Secrets Store CSI Driver is a Go package that provides a way to store and retrieve secrets in Kubernetes. It allows users to mount secrets stored in external secret management systems into their Kubernetes pods. The package is widely used in Kubernetes deployments to securely manage sensitive information such as passwords, API keys, and certificates. However, versions v0.0.15 and v0.0.16 of the driver are vulnerable to a directory traversal attack.
Vulnerability Detail
The directory traversal vulnerability in the Kubernetes Secrets Store CSI Driver allows an attacker who can modify a SecretProviderClassPodStatus/Status resource to write content to the host filesystem and sync file contents to Kubernetes Secrets. This means that an attacker with the ability to modify a specific resource can traverse directories and write arbitrary files on the host system, potentially leading to unauthorized access, data leakage, or even remote code execution. The vulnerability specifically affects paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.
How To Fix
Latest published version: v1.6.1 as of 23 Oct 2026
go get sigs.k8s.io/secrets-store-csi-driver@v1.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.17
This is the first release that contains the fix.
go get sigs.k8s.io/secrets-store-csi-driver@v0.0.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a workaround by manually restricting access to the affected directories on the host system. This can be done by modifying the file permissions or using access control mechanisms provided by the operating system. However, this workaround is not recommended as it may introduce additional complexity and may not fully mitigate the vulnerability.
Conclusion
The directory traversal vulnerability in the Kubernetes Secrets Store CSI Driver can lead to unauthorized access, data leakage, and potential remote code execution. Users of affected versions should upgrade to version 0.0.17 or later to fix the vulnerability. It is important to apply the fix as soon as possible to ensure the security of Kubernetes deployments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sigs.k8s.io/secrets-store-csi-driver →
FAQ
The vulnerability allows an attacker to write arbitrary files on the host system and potentially gain unauthorized access or execute remote code. This can lead to data leakage, compromise of sensitive information, and disruption of Kubernetes deployments.
Users of Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 are affected by this vulnerability. It is recommended for all users of these versions to upgrade to the latest version to mitigate the risk.
There are currently no known public exploits for this vulnerability. However, it is important to apply the recommended fix as soon as possible to prevent potential attacks.
No, this vulnerability requires the attacker to have the ability to modify a specific resource in the Kubernetes cluster. It cannot be exploited remotely without prior access to the cluster.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate severity level. It is important to address this vulnerability in a timely manner to mitigate the potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for sigs.k8s.io/secrets-store-csi-driver.
