CVE-2022-3162: Kubernetes Path Traversal Vulnerability
Summary
CVE-2022-3162: Kubernetes vulnerable to path traversal. Affects github.com/kubernetes/kubernetes across 4 version ranges.
>= 1.22.0, < 1.22.16
>= 1.23.0, < 1.23.14
>= 1.24.0, < 1.24.8
>= 1.25.0, < 1.25.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- k8s.io/kubernetes · Go
- kubernetes · Debian:11
The same CVE-2022-3162 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications. It is widely used in cloud-native environments to facilitate efficient container management. However, Kubernetes is vulnerable to a path traversal vulnerability that allows unauthorized users to read custom resources of a different type in the same API group. This vulnerability affects clusters that meet specific conditions, including the presence of multiple CustomResourceDefinitions sharing the same API group and users having cluster-wide list or watch authorization on one of those custom resources. The vulnerability can lead to unauthorized access to sensitive data and potential security breaches.
Vulnerability Detail
The path traversal vulnerability in Kubernetes allows users with cluster-wide list or watch authorization on one type of namespaced custom resource to read custom resources of a different type in the same API group without proper authorization. This means that an attacker with limited privileges can access sensitive data from custom resources they are not authorized to read. The vulnerability affects clusters with specific configurations, and if exploited, it can result in unauthorized access to sensitive information, potentially leading to data breaches and other security incidents. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: v1.14.10 as of 23 Oct 2026
go get github.com/kubernetes/kubernetes@v1.14.10Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.22.0, < 1.22.161.22.16go get github.com/kubernetes/kubernetes@v1.22.16 -
>= 1.23.0, < 1.23.141.23.14go get github.com/kubernetes/kubernetes@v1.23.14 -
>= 1.24.0, < 1.24.81.24.8go get github.com/kubernetes/kubernetes@v1.24.8 -
>= 1.25.0, < 1.25.41.25.4go get github.com/kubernetes/kubernetes@v1.25.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict cluster-wide list or watch authorization on custom resources to minimize the risk of unauthorized access. By carefully managing the authorization settings and limiting access to only necessary resources, the impact of the vulnerability can be mitigated. However, this workaround may limit the functionality and flexibility of Kubernetes, so upgrading to the patched versions is the recommended long-term solution.
Conclusion
The Kubernetes path traversal vulnerability poses a risk to clusters that meet specific conditions. It allows unauthorized access to custom resources of a different type in the same API group, potentially leading to data breaches and other security incidents. To mitigate the risk, it is crucial to upgrade Kubernetes to the patched versions and regularly update the platform to stay protected against potential vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/kubernetes/kubernetes →
FAQ
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications.
A path traversal vulnerability allows an attacker to access files or directories outside the intended scope of an application by manipulating input parameters or file paths.
The vulnerability allows unauthorized users to read custom resources of a different type in the same API group without proper authorization. This can lead to unauthorized access to sensitive data and potential security breaches.
Clusters are impacted if they have 2+ CustomResourceDefinitions sharing the same API group, users have cluster-wide list or watch authorization on one of those custom resources, and the same users are not authorized to read another custom resource in the same API group.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kubernetes/kubernetes.
