CVE-2017-1002102

Severity: medium (CVSS 5.6 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-03-13 · updated 2026-06-17

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

Affected products

Kubernetes: from 1.3.0 through 1.3.10; from 1.4.0 through 1.4.12; from 1.5.0 through 1.5.8; from 1.6.0 through 1.6.13; from 1.7.0 before 1.7.14; from 1.8.0 before 1.8.9 — fixed in 1.7.14, 1.8.9, 1.9.4

How to fix

Upgrade to a fixed version: Kubernetes 1.7.14, 1.8.9, 1.9.4. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2018:0475
https://github.com/kubernetes/kubernetes/issues/60814
https://access.redhat.com/errata/RHSA-2018:0475
https://github.com/kubernetes/kubernetes/issues/60814

Get alerted when CVE-2017-1002102 or the next vulnerability affects your stack