Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2018-1002105

CriticalPublic exploit

Privilege Escalation in Kubernetes

Published Feb 15, 2022 · Updated Sep 10, 2026 · Also known as DEBIAN-CVE-2018-1002105, GHSA-579h-mv94-g4gp, GO-2022-0792, UBUNTU-CVE-2018-1002105

Key Facts

Patch immediately
  • CVE-2018-1002105 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Kubernetes, Trident (Netapp), Openshift Container Platform (Redhat) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 87% probability of exploitation in the next 30 days.
  • Fixed versions are available, including atomic-enterprise-service-catalog 1:3.10.72-1.git.1450.7d3f435.el7, atomic-openshift 0:3.6.173.0.140-1.git.0.9686d52.el7, atomic-openshift-descheduler 0:3.10.72-1.git.299.953c1c8.el7.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

9.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

87%

Higher than 99.7% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2018-1002105 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.

Affected Products

74 affected entries in total
ProductAffected versionsFixed in
KubernetesKubernetes1.9.12-beta0, >= v1.0.x1.9.11
TridentNetappSee advisoryn/a
Openshift Container PlatformRedhat3.10, 3.11, 3.2, 3.3, 3.4, 3.5, 3.6, 3.8n/a
github.com/kubernetes/kubernetesgoSee advisory1.10.11
kubeadmoracleSee advisory1.9.11-2.1.1.el7
20 more affected products in the full CVE brief

Patched Releases

atomic-enterprise-service-catalog

1:3.10.72-1.git.1450.7d3f435.el7

atomic-openshift

0:3.6.173.0.140-1.git.0.9686d52.el7

atomic-openshift-descheduler

0:3.10.72-1.git.299.953c1c8.el7

atomic-openshift-dockerregistry

0:3.10.72-1.git.390.186ec4f.el7

atomic-openshift-node-problem-detector

0:3.10.72-1.git.252.fa9e8ae.el7

atomic-openshift-web-console

0:3.10.72-1.git.395.d23c438.el7

cockpit

0:160-3.el7

cri-o

1.17.1-lp151.2.2

cri-o-kubeadm-criconfig

1.17.1-lp151.2.2

cri-tools

1.18.0-lp151.2.1

github.com/kubernetes/kubernetes

1.10.11, 1.11.5, 1.12.3

go1.14

1.14-lp151.6.1

go1.14-doc

1.14-lp151.6.1

go1.14-race

1.14-lp151.6.1

golang-github-prometheus-node_exporter

0:3.10.72-1.git.1060.64daa26.el7

kubeadm

1.9.11-2.1.1.el7, 1.18.0-lp151.5.1, 1.22.2-21.2

kubectl

1.9.11-2.1.1.el7

kubelet

1.9.11-2.1.1.el7, 1.22.2-21.2

Kubernetes

1.11.5-1.ph2, 1.12.5-2.ph3, 1.17.4-1, 1.9.6-2.ph1, v1.10.11, v1.11.5, v1.12.3, <=1.9.11

kubernetes-apiserver

1.18.0-lp151.5.1, 1.22.2-21.2

kubernetes-apiserver-minus1

1.21.5-21.2

kubernetes-client

1.18.0-lp151.5.1, 1.22.2-21.2

kubernetes-controller-manager

1.18.0-lp151.5.1, 1.22.2-21.2

kubernetes-controller-manager-minus1

1.21.5-21.2

kubernetes-coredns

1.8.4-21.2

Timeline

  1. Publicly disclosed

    Feb 15, 2022

  2. Last updated

    Sep 10, 2026

Weakness Type

  • CWE-269 Improper Privilege Management
  • CWE-305 Authentication Bypass by Primary Weakness
  • CWE-388

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2018-1002105 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo