CVE-2019-11243

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-22 · updated 2026-06-17
Weakness: CWE-271

Description

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()

Affected products

Kubernetes: from 1.12.0 through 1.12.4; 1.13.0
NetApp Trident: all versions

References

http://www.securityfocus.com/bid/108053
https://github.com/kubernetes/kubernetes/issues/76797
https://security.netapp.com/advisory/ntap-20190509-0002/
http://www.securityfocus.com/bid/108053
https://github.com/kubernetes/kubernetes/issues/76797
https://security.netapp.com/advisory/ntap-20190509-0002/

Get alerted when CVE-2019-11243 or the next vulnerability affects your stack