Description
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | v1.3.x, v1.4.x, v1.5.x, v1.6.x, unspecified – < v1.7.14, unspecified – < v1.8.9, unspecified – < v1.9.4 | v1.7.14 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.7.16+dfsg-1 | — |
| Debian 13 | kubernetes | 1.7.16+dfsg-1 | — |
| Debian 12 | kubernetes | 1.7.16+dfsg-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +11 | 3.3.1.46.11-1.git.4.e236015.el7 | RHSA-2018:0475 |
| Red Hat OpenShift 3 | atomic-openshift-service-catalog +2 | 3.6.173.0.96-1.git.4.e6301f8.el7 | RHSA-2018:0475 |
| Red Hat OpenShift 3 | atomic-openshift-template-service-broker | 3.7.23-1.git.5.83efd71.el7 | RHSA-2018:0475 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kubeadm +2 | 1.9.1-2.1.5.el7 | ELSA-2018-4061 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.3.0, < 1.7.14 | 1.7.14 | GHSA-mm7g-f2gg-cw8g |
| Go | k8s.io/kubernetes | >= 1.8.0, < 1.8.9 | 1.8.9 | GHSA-mm7g-f2gg-cw8g |
| Go | k8s.io/kubernetes | >= 1.9.0, < 1.9.4 | 1.9.4 | GHSA-mm7g-f2gg-cw8g |
| Go | k8s.io/kubernetes | >= 1.3.0, < 1.7.14 · >= 1.8.0, < 1.8.9 · >= 1.9.0, < 1.9.4 | 1.7.14, 1.8.9, 1.9.4 | GO-2023-1977 |
Advisories 3
- RHSA-2018:0475 Red Hat Security Advisory: Red Hat OpenShift Container Platform security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- ELSA-2018-4061 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 5, 2018
References
- RHSA-2018:0475 vendor-advisory
- https://github.com/kubernetes/kubernetes/issues/60814