What’s Vulnerable › Vulnerabilities

CVE-2017-1002101

• Severity: critical (CVSS 9.6 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-03-13 · updated 2026-06-17
• Weakness: CWE-59

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.

Affected products

• Kubernetes: from 1.3.0 through 1.3.10; from 1.4.0 through 1.4.12; from 1.5.0 through 1.5.8; from 1.6.0 through 1.6.13; from 1.7.0 before 1.7.14; from 1.8.0 before 1.8.9 — fixed in 1.7.14, 1.8.9, 1.9.4

How to fix

Upgrade to a fixed version: Kubernetes 1.7.14, 1.8.9, 1.9.4. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
• https://access.redhat.com/errata/RHSA-2018:0475
• https://github.com/bgeesaman/subpath-exploit/
• https://github.com/kubernetes/kubernetes/issues/60813
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
• https://access.redhat.com/errata/RHSA-2018:0475
• https://github.com/bgeesaman/subpath-exploit/
• https://github.com/kubernetes/kubernetes/issues/60813

Get alerted when CVE-2017-1002101 or the next vulnerability affects your stack