Description
In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | < 1.19.3, < 1.18.10, < 1.17.13 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.19.3-1 | — |
| Debian 13 | kubernetes | 1.19.3-1 | — |
| Debian 12 | kubernetes | 1.19.3-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.20.0-0.rhaos4.7.git8921e00.el7.51 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | cri-tools | 1.18.0-3.el7 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | ignition +1 | 2.9.0-2.rhaos4.7.git1d56dc8.el8 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | openshift +1 | 4.7.0-202102060108.p0.git.97095.7271b90.el7 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | python-rsa +1 | 4.7-1.el8 | RHSA-2020:5634 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | kubernetes | 1.17.13-4.21.2 | SUSE-SU-2020:3760-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kubernetes/kubernetes | < 1.17.13 | 1.17.13 | GHSA-5x96-j797-5qqw |
| Go | github.com/kubernetes/kubernetes | >= 1.18.0, < 1.18.10 | 1.18.10 | GHSA-5x96-j797-5qqw |
| Go | github.com/kubernetes/kubernetes | >= 1.19.0, < 1.19.3 | 1.19.3 | GHSA-5x96-j797-5qqw |
| Go | k8s.io/kubernetes | < 1.17.13 · >= 1.18.0, < 1.18.10 · >= 1.19.0, < 1.19.3 | 1.17.13, 1.18.10, 1.19.3 | GO-2024-2754 |
Advisories 3
- RHSA-2020:5634 Red Hat Security Advisory: OpenShift Container Platform 4.7.0 packages security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2020:3760-1 Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package SUSE / openSUSE Security Updates · Feb 4, 2026