CVE-2021-4178
fabric8 kubernetes-client vulnerable
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
- Record
CVE-2021-4178- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
- Record
CVE-2021-4178- Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2022-6304 No score
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
- Record
EUVD-2022-6304- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-98g7-rxmf-rrxm
fabric8 kubernetes-client vulnerable
fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing.
- Record
GHSA-98g7-rxmf-rrxm- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-502
- Updated
- 2026-11-02
OSV
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
- Record
CVE-2021-4178- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-98g7-rxmf-rrxm
fabric8 kubernetes-client vulnerable
fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing.
- Record
GHSA-98g7-rxmf-rrxm- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502, CWE-94
- Updated
- 2026-11-02
OSVRHSA-2023:3299
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3299- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.fabric8:kubernetes-clientMaven |
5.0.0-beta-1 up to 5.0.3 | 5.0.3 |
io.fabric8:kubernetes-clientMaven |
5.1.0 up to 5.1.2 | 5.1.2 |
io.fabric8:kubernetes-clientMaven |
5.2.0 up to 5.3.2 | 5.3.2 |
io.fabric8:kubernetes-clientMaven |
5.5.0 up to 5.7.4 | 5.7.4 |
io.fabric8:kubernetes-clientMaven |
5.8.0 up to 5.8.1 | 5.8.1 |
io.fabric8:kubernetes-clientMaven |
5.9.0 up to 5.10.2 | 5.10.2 |
io.fabric8:kubernetes-clientMaven |
5.11.0 up to 5.11.2 | 5.11.2 |
io.fabric8:kubernetes-clientMaven |
5.0.0-beta-1 up to 5.0.3, plus listed versions 5.0.05.0.15.0.2 |
5.0.3 |
io.fabric8:kubernetes-clientMaven |
5.1.0 up to 5.1.2, plus listed versions 5.1.1 |
5.1.2 |
io.fabric8:kubernetes-clientMaven |
5.2.0 up to 5.3.2, plus listed versions 5.2.15.3.05.3.1 |
5.3.2 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.fabric8:kubernetes-clientMaven |
5.5.0 up to 5.7.4, plus listed versions 5.6.05.7.05.7.15.7.25.7.3 |
5.7.4 |
io.fabric8:kubernetes-clientMaven |
5.9.0 up to 5.10.2, plus listed versions 5.10.05.10.1 |
5.10.2 |
io.fabric8:kubernetes-clientMaven |
5.11.0 up to 5.11.2, plus listed versions 5.11.1 |
5.11.2 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 From an advisory covering 16 CVEs |
before 0:4.13.1684911916-1.el8 | 0:4.13.1684911916-1.el8 |
jenkinsRed Hat:ocp_tools:4.13::el8 From an advisory covering 16 CVEs |
before 0:2.387.3.1684911776-3.el8 | 0:2.387.3.1684911776-3.el8 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | shoucheng3/fabric8io__kubernetes-client_CVE-2021-4178_5-0-2 | 2025-08-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-4178 is a medium vulnerability (CVSS 6.7) in Redhat A-mq Streams, published July 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in io.fabric8:kubernetes-client 5.0.3.
References
bugzilla.redhat.com/show_bug.cgi?id=2034388
access.redhat.com/security/cve/CVE-2021-4178
github.com/advisories/GHSA-98g7-rxmf-rrxm
nvd.nist.gov/vuln/detail/CVE-2021-4178
Show 78 moreShow less
mend.io/vulnerability-database/CVE-2021-4178
issues.redhat.com/browse/PITEAM-10
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3299.json
cve.org/CVERecord?id=CVE-2020-7692
tanzu.vmware.com/security/cve-2022-22978
blogs.apache.org/security/entry/cve-2022-42889
lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
seclists.org/oss-sec/2022/q4/22
jenkins.io/security/advisory/2023-01-24
commons.apache.org/proper/commons-fileupload/security-reports.html