Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2018-1002102 Details

Description

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:2.6 LOWVector:CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

CNA: [email protected]CVSS-B:2.6 LOWVector:CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/kubernetes/kubernetes/issues/85867	CVE	Issue TrackingMitigationThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/	CVE
https://github.com/kubernetes/kubernetes/issues/85867	[email protected]	Issue TrackingMitigationThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-601	URL Redirection to Untrusted Site ('Open Redirect')	[email protected]
CWE-601	URL Redirection to Untrusted Site ('Open Redirect')	[email protected]

Affected Products

Product	Versions
kubernetes kubernetes	>= 1.10.0, <= 1.13.13 1.14.0 alpha0 1.14.0 alpha1
CPE cpe:2.3:a:kubernetes:kubernetes:::::::: cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha0:::::: cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha1:::::: Remediation No remediation found in references.
fedoraproject fedora	31
CPE cpe:2.3:o:fedoraproject:fedora:31:::::::* Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Jan 16, 2020	Modified Analysis	[email protected]
Jan 12, 2020	CVE Modified	[email protected]
Dec 13, 2019	Initial Analysis	[email protected]