Description
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | <= 1.19.3, <= 1.18.10, <= 1.17.13, < 1.20.0-alpha2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.20.0-1 | — |
| Debian 13 | kubernetes | 1.20.0-1 | — |
| Debian 12 | kubernetes | 1.20.0-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openshift Data Foundation 4 | mcg | 5.9.0-28.61dcf87.5.9.el8 | RHSA-2021:5085 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | kubernetes | 1.17.13-4.21.2 | SUSE-SU-2020:3760-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | local-path-provisioner | 0.0.24-5 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gostatsd | 28.3.0-r33 | — |
| Wolfi rolling | kubeflow-access-management | No fix yet | — |
| Wolfi rolling | kubeflow-pipelines | 2.2.0-r3 | — |
| Wolfi rolling | newrelic-nri-statsd | 2.14.0-r2 | — |
| Wolfi rolling | spark-operator | 2.1.0-r8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/client-go | >= 0.19.0, < 0.19.6 | 0.19.6 | GHSA-8cfg-vx93-jvxw |
| Go | k8s.io/client-go | >= 0.20.0-alpha.0, < 0.20.0-alpha.2 | 0.20.0-alpha.2 | GHSA-8cfg-vx93-jvxw |
| Go | k8s.io/client-go | >= 0.18.0, < 0.18.14 | 0.18.14 | GHSA-8cfg-vx93-jvxw |
| Go | k8s.io/client-go | < 0.17.16 | 0.17.16 | GHSA-8cfg-vx93-jvxw |
| Go | k8s.io/client-go | < 0.20.0-alpha.2 | 0.20.0-alpha.2 | GO-2021-0064 |
| Go | k8s.io/kubernetes | < 1.20.0-alpha.2 | 1.20.0-alpha.2 | GHSA-8cfg-vx93-jvxw |
Advisories 3
- RHSA-2021:5085 Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- SUSE-SU-2020:3760-1 Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package SUSE / openSUSE Security Updates · Feb 4, 2026