CVE-2019-11255: Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-05 · updated 2026-06-17
Weakness: CWE-20

Description

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.

Affected products

Kubernetes External-Provisioner: from 0.4.1 through 0.4.2; from 1.0.0 through 1.0.1; from 1.1.0 through 1.2.1; 1.3.0
Kubernetes External-Resizer: from 0.1.0 through 0.2.0
Kubernetes External-Snapshotter: from 0.4.0 through 0.4.1; from 1.0.0 through 1.0.1; from 1.1.0 through 1.2.1
Red Hat OpenShift Container Platform 4.18: 3.11, 4.1, 4.2

References

Get alerted when CVE-2019-11255 or the next vulnerability affects your stack