CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NCVE-2020-8568
Medium (6.5) in kubernetes secrets store csi driver. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in sigs.k8s.io/secrets-store-csi-driver 0.0.17.
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-22, CWE-20, CWE-24
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kubernetes:secrets_store_csi_driver
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5cgx-vhfp-6cf9 | Go | sigs.k8s.io/secrets-store-csi-driver | >=0.0.15 <0.0.17 | 0.0.17 |
| GO-2022-0629 | Go | sigs.k8s.io/secrets-store-csi-driver | >=0.0.15 <0.0.17 | 0.0.17 |