Description
In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | < 1.19.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | openshift +1 | 4.6.0-202012051246.p0.git.94231.efc9027.el7 | RHSA-2020:5260 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kubernetes/kubernetes | < 1.19.3 | 1.19.3 | GHSA-5xfg-wv98-264m |
| Go | k8s.io/kubernetes | < 1.19.3 | 1.19.3 | GO-2024-2755 |
Advisories 2
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RHSA-2020:5260 Red Hat Security Advisory: OpenShift Container Platform 4.6.8 security and packages update Red Hat Security Advisories (RHSA) · Nov 22, 2025