CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-11243
High (8.1). EPSS 1.5% chance of exploitation in the next 30 days. Fixed in k8s.io/kubernetes 1.12.5, 1.13.1.
In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-212, CWE-271
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kubernetes:kubernetes
- netapp:trident
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gc2p-g4fg-29vh | Go | k8s.io/kubernetes | >=1.12.0 <1.12.5 | 1.12.5 |
| GHSA-gc2p-g4fg-29vh | Go | k8s.io/kubernetes | >=1.13.0 <1.13.1 | 1.13.1 |
| GO-2025-3645 | Go | k8s.io/kubernetes | >=1.12.0 <1.12.5 >=1.13.0 <1.13.1 | 1.12.5, 1.13.1 |