CoreCVE
Back

HIGH

Kubernetes kube-apiserver allows access to custom resources via wrong scope

Published Aug 29, 2019

Description

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

Affected products

Remediation

Vendor solution

To mitigate, remove authorization rules that grant access to cluster-scoped resources within namespaces. For example, RBAC roles and clusterroles intended to be referenced by namespaced rolebindings should not grant access to resources:[*], apiGroups:[*], or grant access to cluster-scoped custom resources.

Weaknesses (3)

CWE-20

Improper Input Validation

CWE-284

CWE-863

Incorrect Authorization

References (18)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner kubernetes
Published Aug 29, 2019
Updated Sep 16, 2024
Reserved Apr 17, 2019
Link CVE-2019-11247
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-11247
Red Hat
Severity Moderate
Public date Aug 5, 2019
Links CVE-2019-11247 - Bugzilla
GHSA-FP37-C92Q-4PWQ