The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Kubernetes | — | Upgrade Kubernetes to version 1.2.0 | Jun 14, 2018 | Feb 3, 2016 |
| Redhat Openshift | — | Upgrade nodejs-ansi-wrapUpgrade nodejs-preserveUpgrade nodejs-regex-cacheUpgrade nodejs-string-lengthUpgrade nodejs-slideUpgrade nodejs-for-ownUpgrade nodejs-filename-regexUpgrade nodejs-anymatchUpgrade nodejs-error-exUpgrade nodejs-fromUpgrade nodejs-readdirpUpgrade nodejs-is-dotfileUpgrade heapsterUpgrade nodejs-glob-parentUpgrade nodejs-expand-bracketsUpgrade nodejs-lodash.restparamUpgrade nodejs-is-npmUpgrade nodejs-duplexifyUpgrade nodejs-semver-diffUpgrade jenkinsUpgrade nodejs-os-tmpdirUpgrade nodejs-lodash.createassignerUpgrade nodejs-update-notifierUpgrade nodejs-micromatchUpgrade nodejs-ps-treeUpgrade nodejs-semverUpgrade nodejs-normalize-pathUpgrade nodejs-timed-outUpgrade nodejs-capture-stack-traceUpgrade nodejs-lodash.keysUpgrade nss_wrapperUpgrade nodejs-latest-versionUpgrade nodejs-pinkie-promiseUpgrade nodejs-package-jsonUpgrade nodejs-mkdirpUpgrade openshift-ansibleUpgrade nodejs-fill-rangeUpgrade nodejs-align-textUpgrade nodejs-is-extendableUpgrade nodejs-lodash.defaultsUpgrade nodejs-is-streamUpgrade nodejs-map-streamUpgrade nodejs-osenvUpgrade nodejs-lodash.assignUpgrade nodejs-object-assignUpgrade nodejs-is-binary-pathUpgrade nodejs-array-uniqueUpgrade nodejs-read-all-streamUpgrade nodejs-lowercase-keysUpgrade nodejs-prepend-httpUpgrade nodejs-arrifyUpgrade nodejs-pinkieUpgrade nodejs-nodemonUpgrade nodejs-async-eachUpgrade nodejs-chokidarUpgrade nodejs-splitUpgrade nodejs-throughUpgrade nodejs-isobjectUpgrade nodejs-randomaticUpgrade nodejs-rcUpgrade nodejs-es6-promiseUpgrade nodejs-is-primitiveUpgrade nodejs-os-homedirUpgrade nodejs-bracesUpgrade nodejs-is-equal-shallowUpgrade nodejs-url-parse-laxUpgrade atomic-openshiftUpgrade nodejs-duplexerUpgrade nodejs-unzip-responseUpgrade nodejs-success-symbolUpgrade nodejs-repeat-elementUpgrade nodejs-iniUpgrade nodejs-lodash.baseassignUpgrade nodejs-for-inUpgrade nodejs-kind-ofUpgrade nodejs-touchUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-lazy-cacheUpgrade nodejs-is-numberUpgrade nodejs-lodash.basecopyUpgrade nodejs-write-file-atomicUpgrade nodejs-glob-baseUpgrade nodejs-gotUpgrade nodejs-extglobUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-node-status-codesUpgrade nodejs-ansi-greenUpgrade nodejs-xdg-basedirUpgrade nodejs-create-error-classUpgrade openshiftUpgrade nodejs-uuidUpgrade nodejs-lodash.isargumentsUpgrade nodejs-registry-urlUpgrade nodejs-parse-jsonUpgrade nodejs-expand-rangeUpgrade nodejs-deep-extendUpgrade nodejs-is-redirectUpgrade nodejs-is-plain-objUpgrade nodejs-event-streamUpgrade nodejs-is-globUpgrade origin-kibanaUpgrade nodejs-end-of-streamUpgrade openvswitchUpgrade nodejs-strip-json-commentsUpgrade nodejs-pause-streamUpgrade nodejs-object.omitUpgrade nodejs-lodash.getnativeUpgrade nodejs-configstoreUpgrade nodejs-stream-combinerUpgrade nodejs-optimistUpgrade nodejs-graceful-fsUpgrade nodejs-is-extglobUpgrade nodejs-lodash.isarrayUpgrade nodejs-undefsafeUpgrade nodejs-binary-extensionsUpgrade nodejs-arr-diffUpgrade nodejs-arr-flattenUpgrade nodejs-parse-glob | Jun 18, 2018 | Jan 11, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 11, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub