GO-2024-2780 CVE-2019-11245 GHSA-r76g-g87f-vw8f

Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes

Medium Go

Severity: 4.9 / 10; Medium · CVSS 3.0
Exploit chance (EPSS): 0.60%; Chance of exploitation in the next 30 days. Higher than 48.67% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-266 Incorrect Privilege Assignment; CWE-703 Improper Check or Handling of Exceptional Conditions
Fix: Available; 2 packages have a fixed version

Description

Affected versions

Go

Package	Vulnerable	Fixed in
k8s.io/kubernetes	`>= 1.13.0, < 1.13.7` `>= 1.14.0, < 1.14.3`	`1.13.7` `1.14.3`
k8s.io/kubernetes/cmd/kubelet	`>= 1.14.0, < 1.14.3`	`1.14.3`
k8s.io/kubernetes/cmd/kubelet	`>= 1.13.0, < 1.13.7`	`1.13.7`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

k8s.io/kubernetes Go → `1.14.3`

go

go get k8s.io/kubernetes@v1.14.3 && go mod tidy

k8s.io/kubernetes/cmd/kubelet Go → `1.14.3`

go

go get k8s.io/kubernetes/cmd/kubelet@v1.14.3 && go mod tidy

Severity breakdown

CVSS 3.0 4.9

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack vector: Local
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

Weakness

CWE-266: Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

CWE-703: Improper Check or Handling of Exceptional Conditions

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

References

Advisories

Packages

github.com/kubernetes/kubernetes

Timeline

Apr 24, 2024 Published
Mar 3, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-r6j8-c6r2-37rr kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass	Medium	Also affects k8s.io/kubernetes
GHSA-4x4m-3c2p-qppc Kubernetes Nodes can delete themselves by adding an OwnerReference	Medium	Also affects k8s.io/kubernetes
GHSA-hj2p-8wj8-pfq4 kubernetes allows nodes to bypass dynamic resource allocation authorization checks	Low	Also affects k8s.io/kubernetes
GO-2025-3547 Kubernetes kube-apiserver Vulnerable to Race Condition	Low	Also affects k8s.io/kubernetes
GHSA-3wgm-2gw2-vh5m Kubernetes GitRepo Volume Inadvertent Local Repository Access	Medium	Also affects k8s.io/kubernetes
GHSA-vv39-3w5q-974q Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API	Medium	Also affects k8s.io/kubernetes
GHSA-jgfp-53c3-624w Node Denial of Service via kubelet Checkpoint API	Medium	Also affects k8s.io/kubernetes
GHSA-27wf-5967-98gx Kubernetes kubelet arbitrary command execution	High	Also affects k8s.io/kubernetes

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor