CVSS 3.0
5.6 mediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:NCVE-2017-1002102
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kubernetes:kubernetes
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mm7g-f2gg-cw8g | Go | k8s.io/kubernetes | >=1.3.0 <1.7.14 | 1.7.14 |
| GHSA-mm7g-f2gg-cw8g | Go | k8s.io/kubernetes | >=1.8.0 <1.8.9 | 1.8.9 |
| GHSA-mm7g-f2gg-cw8g | Go | k8s.io/kubernetes | >=1.9.0 <1.9.4 | 1.9.4 |
| GO-2023-1977 | Go | k8s.io/kubernetes | >=1.3.0 <1.7.14 >=1.8.0 <1.8.9 >=1.9.0 <1.9.4 | 1.7.14, 1.8.9, 1.9.4 |