What’s Vulnerable › Vulnerabilities

CVE-2020-8567: Kubernetes Secrets Store CSI Driver plugin directory traversals

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-21 · updated 2026-06-17
• Weakness: CWE-24

Description

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.

Affected products

• Google Secret Manager Provider For Secret Store Csi Driver: before 0.2.0 — fixed in 0.2.0
• HashiCorp Vault Provider For Secrets Store Csi Driver: before 0.0.6 — fixed in 0.0.6
• Microsoft Azure Key Vault Provider For Secrets Store Csi Driver: before 0.0.10 — fixed in 0.0.10
• Kubernetes Secrets Store CSI Driver: from Vault Plugin before v0.0.6; from Azure Plugin before v0.0.10; from GCP Plugin before v0.2.0 — fixed in v0.0.6, v0.0.10, v0.2.0

How to fix

Upgrade to a fixed version: Google Secret Manager Provider For Secret Store Csi Driver 0.2.0; HashiCorp Vault Provider For Secrets Store Csi Driver 0.0.6; Microsoft Azure Key Vault Provider For Secrets Store Csi Driver 0.0.10; Kubernetes Secrets Store CSI Driver v0.0.6, v0.0.10, v0.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384
• https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY
• https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384
• https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY

Get alerted when CVE-2020-8567 or the next vulnerability affects your stack