CVE-2019-11245
kubelet-started container uid changes to root after first restart or if image is already pulled to the node
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
kubelet-started container uid changes to root after first restart or if image is already pulled to the node
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
- Record
CVE-2019-11245- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-703
- Updated
- 2026-11-02
EUVDEUVD-2024-1293
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
- Record
EUVD-2024-1293- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r76g-g87f-vw8f
Kubelet Incorrect Privilege Assignment
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
- Record
GHSA-r76g-g87f-vw8f- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-266, CWE-703
- Updated
- 2026-11-02
NVD
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
- Record
CVE-2019-11245- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-703, CWE-264
- Updated
- 2026-11-02
OSV
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
- Record
CVE-2019-11245- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-r76g-g87f-vw8f
Kubelet Incorrect Privilege Assignment
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
- Record
GHSA-r76g-g87f-vw8f- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-266, CWE-703
- Updated
- 2026-11-02
OSVGO-2024-2780 No score
Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes
Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes
- Record
GO-2024-2780- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15424-1 No score
govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15424-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
k8s.io/kubernetes/cmd/kubeletGo |
1.14.0 up to 1.14.3 | 1.14.3 |
k8s.io/kubernetes/cmd/kubeletGo |
1.13.0 up to 1.13.7 | 1.13.7 |
k8s.io/kubernetesGo |
1.13.0 up to 1.13.7, 1.14.0 up to 1.14.3 | 1.13.71.14.3 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 44 CVEs |
before 0.0.20250807T150727-1.1 | 0.0.20250807T150727-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11245 is a medium vulnerability (CVSS 4.9) in Kubernetes, published August 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in k8s.io/kubernetes/cmd/kubelet 1.14.3.
References
github.com/kubernetes/kubernetes/issues/78308
security.netapp.com/advisory/ntap-20190919-0003
nvd.nist.gov/vuln/detail/CVE-2019-11245
bugzilla.redhat.com/show_bug.cgi?id=1715726
Show 47 moreShow less
pkg.go.dev/vuln/GO-2024-2780
suse.com/security/cve/CVE-2015-7561