Description
The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | 1.16, 1.17, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.18.0-1 | — |
| Debian 13 | kubernetes | 1.18.0-1 | — |
| Debian 12 | kubernetes | 1.18.0-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | machine-config-daemon | 4.5.0-202007012112.p0.git.2527.d12c3da.el8 | RHSA-2020:2413 |
| Red Hat OpenShift 4 | openshift +1 | 4.5.0-202007012112.p0.git.0.582d7fc.el7 | RHSA-2020:2413 |
Advisories 2
- RHSA-2020:2413 Red Hat Security Advisory: OpenShift Container Platform 4.5 package security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026