CVE-2019-11245: kubelet-started container uid changes to root after first restart or if image is already pulled to the node

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-08-29 · updated 2026-06-17
Weakness: CWE-703

Description

In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.

Affected products

Kubernetes: 1.13.6, 1.14.2

References

https://github.com/kubernetes/kubernetes/issues/78308
https://security.netapp.com/advisory/ntap-20190919-0003/
https://github.com/kubernetes/kubernetes/issues/78308
https://security.netapp.com/advisory/ntap-20190919-0003/

Get alerted when CVE-2019-11245 or the next vulnerability affects your stack