Description
In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | v1.12 – ≤ v1.12.4, v1.13 – ≤ v1.13.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250506T153719-1.1 | openSUSE-SU-2025:15059-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.12.0, < 1.12.5 | 1.12.5 | GHSA-gc2p-g4fg-29vh |
| Go | k8s.io/kubernetes | >= 1.13.0, < 1.13.1 | 1.13.1 | GHSA-gc2p-g4fg-29vh |
| Go | k8s.io/kubernetes | >= 1.12.0, < 1.12.5 · >= 1.13.0, < 1.13.1 | 1.12.5, 1.13.1 | GO-2025-3645 |
Advisories 1
- openSUSE-SU-2025:15059-1 govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026