Description
In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | unspecified – < v1.9.10, unspecified – < v1.10.6, unspecified – < v1.11.2 | v1.9.10 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.9.0, < 1.9.10 | 1.9.10 | GHSA-wqwf-x5cj-rg56 |
| Go | k8s.io/kubernetes | >= 1.10.0, < 1.10.6 | 1.10.6 | GHSA-wqwf-x5cj-rg56 |
| Go | k8s.io/kubernetes | >= 1.11.0, < 1.11.2 | 1.11.2 | GHSA-wqwf-x5cj-rg56 |
| Go | k8s.io/kubernetes | >= 1.9.0, < 1.9.10 · >= 1.10.0, < 1.10.6 · >= 1.11.0, < 1.11.2 | 1.9.10, 1.10.6, 1.11.2 | GO-2022-0886 |
Advisories 1
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026