Description
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | v1.3.x, v1.4.x, v1.5.x, v1.6.x, unspecified – < v1.7.14, unspecified – < v1.8.9, unspecified – < v1.9.4 | v1.7.14 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.7.16+dfsg-1 | — |
| Debian 13 | kubernetes | 1.7.16+dfsg-1 | — |
| Debian 12 | kubernetes | 1.7.16+dfsg-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +11 | 3.3.1.46.11-1.git.4.e236015.el7 | RHSA-2018:0475 |
| Red Hat OpenShift 3 | atomic-openshift-service-catalog +2 | 3.6.173.0.96-1.git.4.e6301f8.el7 | RHSA-2018:0475 |
| Red Hat OpenShift 3 | atomic-openshift-template-service-broker | 3.7.23-1.git.5.83efd71.el7 | RHSA-2018:0475 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | cri-o | 1.17.1-lp151.2.2 | openSUSE-SU-2020:0554-1 |
| openSUSE Leap 15.1 | cri-tools | 1.18.0-lp151.2.1 | openSUSE-SU-2020:0554-1 |
| openSUSE Leap 15.1 | go1.14 | 1.14-lp151.6.1 | openSUSE-SU-2020:0554-1 |
| openSUSE Leap 15.1 | kubernetes | 1.18.0-lp151.5.1 | openSUSE-SU-2020:0554-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kubeadm +2 | 1.9.1-2.1.5.el7 | ELSA-2018-4061 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
bgeesaman/subpath-exploit ★ 34 · Mar 22, 2018
Writeup of CVE-2017-1002101 with sample "exploit"/escape
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2018:0475 Red Hat Security Advisory: Red Hat OpenShift Container Platform security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- openSUSE-SU-2020:0554-1 Security update for kubernetes SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2018-4061 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 5, 2018
References
- RHSA-2018:0475 vendor-advisory
- https://github.com/kubernetes/kubernetes/issues/60813
- https://github.com/bgeesaman/subpath-exploit/
- openSUSE-SU-2020:0554 vendor-advisory