Every CVE Search/ Get API key

CVE-2018-1002102

Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints

2.6 LowFix available

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.62%Unchanged since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 2.6

Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Record
CVE-2018-1002102
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-601
Updated
2026-11-02
EUVDEUVD-2018-2081 2.6

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Record
EUVD-2018-2081
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Updated
2026-11-03
NVD 2.6

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Record
CVE-2018-1002102
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
CVSS 2.0
2.1 LowAV:N/AC:H/Au:S/C:P/I:N/A:N
Weakness
CWE-601
Updated
2026-11-02
OSV 2.6

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Record
CVE-2018-1002102
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-1002102 2.6

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Record
DEBIAN-CVE-2018-1002102
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2020:5363 6.4

Red Hat Security Advisory: OpenShift Container Platform 3.11.346 security and bug fix update

Record
RHSA-2020:5363
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-1002102 2.6

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Record
UBUNTU-CVE-2018-1002102
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kubernetes
Debian:12
 before 1.17.4-1
1.17.4-1
kubernetes
Debian:13
 before 1.17.4-1
1.17.4-1
kubernetes
Debian:14
 before 1.17.4-1
1.17.4-1
atomic-openshift
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-clients
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-clients-redistributable
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-docker-excluder
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-excluder
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-hyperkube
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-hypershift
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
Show 6 moreShow less
Affected packages
PackageAffectedFixed
atomic-openshift-master
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-node
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-pod
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-template-service-broker
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
atomic-openshift-tests
Red Hat:openshift:3.11::el7
 before 0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7

History

History
RecordedChangedSources
affected
aliases, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1002102 is a low vulnerability (CVSS 2.6) in Kubernetes, published December 5, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in kubernetes 1.17.4-1.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open