Every CVE Search/ Get API key

CVE-2022-2385

AccessKeyID validation bypass

8.1 HighFix available

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.10%Up 0.2 points since Jul 13, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.1

AccessKeyID validation bypass

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Record
CVE-2022-2385
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2022-6388 8.1

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Record
EUVD-2022-6388
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-pp3f-98qg-5g75 8.1

aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Record
GHSA-pp3f-98qg-5g75
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
NVD 8.1

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Record
CVE-2022-2385
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
OSV 8.1

AccessKeyID validation bypass

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Record
CVE-2022-2385
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-pp3f-98qg-5g75 8.1

aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Record
GHSA-pp3f-98qg-5g75
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVGO-2022-0547 No score

aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator

aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator

Record
GO-2022-0547
Updated
2026-11-02
OSVSUSE-SU-2022:2583-1 No score

Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues:

  • CVE-2022-2385: Fixed AccessKeyID validation bypass (bsc#1201395).
Record
SUSE-SU-2022:2583-1
Updated
2026-11-02
OSVSUSE-SU-2026:2643-1 No score

Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues

  • CVE-2022-1996: CORS bypass (bsc#1200528).
  • CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass (bsc#1201395).
  • CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store.
  • CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad.
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265842).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266651).

Changes for aws-iam-authenticator:

  • Update to version 0.7.18
  • Merge pull request (#1062) from CaidenBorrego/new-release
  • Creating new release for CVE mitigation
  • Merge pull request (#1057) from CaidenBorrego/caidenb-versionbump
  • Merge remote-tracking branch 'upstream/master' into caidenb-versionbump
  • Bump x/net and x/sys to remediate CVEs (bsc#1266651, CVE-2026-39821)
  • Update to 0.7.17
  • Merge pull request #1051 from CaidenBorrego/caidenb-versionbump
  • bumping version from 0.7.16->0.7.17
  • Merge pull request #1047 from CaidenBorrego/caidenb-reservedprefix-fix
  • fix: honor reservedPrefixConfig for ConfigMap and CRD backends
  • Merge pull request #1046 from CaidenBorrego/caidenb-gorunner-bump
  • fix: reject malformed mapping ARN in userIDStrict mode for dynamic files
  • Update to 0.7.16
  • Merge pull request #1041 from ronaldngounou/rngounou/bump-go-1.26.3
  • Pin GitHub Actions to full-length commit SHAs
  • fix: bump go version to 1.26.3 for CVEs
  • from version 0.7.15
  • Merge pull request #1035 from Ganiredi/bump-version-0.7.15
  • Bump version to 0.7.15
  • Merge pull request #1030 from Ganiredi/1.36-k8s-deps
  • 1.36.0 dependency update
  • from version 0.7.14
  • Merge pull request #1029 from CaidenBorrego/caidenb-gorunner-bump
  • Bump version to 0.7.14
  • Bumping gorunner image tag in Dockerfile for CVE mitigation
  • from version 0.7.13
  • Merge pull request #1020 from dheeraj-coding/master
  • feat: add manual dispatch function for create-release.yml
  • Merge pull request #1019 from dheeraj-coding/master
  • fix: create-release workflow failures
  • Merge pull request #1017 from Ganiredi/1.36-k8s-deps
  • Merge pull request #1018 from dheeraj-coding/master
  • fix: build failure due to stale gcb image by updating to latest
  • Release 0.7.13
  • Merge pull request #1016 from Ganiredi/1.36-k8s-deps
  • Merge branch 'master' into 1.36-k8s-deps
  • Merge pull request #1013 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-be00ae3611
  • 1.36.rc release
  • Merge pull request #1015 from dheeraj-coding/master
  • fix: bump go version 1.26.2 for CVEs
  • chore(deps): Bump the misc-dependencies group across 3 directories with 6 updates (bsc#1265842, CVE-2026-33814)
  • Merge pull request #1011 from kubernetes-sigs/dependabot/go_modules/observability-dependencies-9e34dd3c34
  • Merge pull request #1009 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-b5e1eeb2d5
  • Merge pull request #1004 from bryantbiggs/chore/fix-goreleaser-deprecations
  • Merge pull request #1010 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-7118f1d525
  • chore(deps): Bump the observability-dependencies group across 2 directories with 2 updates
  • chore(deps): Bump the aws-dependencies group across 2 directories with 6 updates
  • chore(deps): Bump the misc-dependencies group across 3 directories with 2 updates
  • Merge pull request #1008 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-3ce7b5fcac
  • chore(deps): Bump the aws-dependencies group across 2 directories with 12 updates
  • Merge pull request #1006 from kubernetes-sigs/dependabot/go_modules/k8s-dependencies-09346e948b
  • chore(deps): Bump the k8s-dependencies group across 3 directories with 8 updates
  • Merge pull request #1005 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-508cd0fd8e
  • chore(deps):…
Record
SUSE-SU-2026:2643-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sigs.k8s.io/aws-iam-authenticator
Go
 before 0.5.9
0.5.9
aws-iam-authenticator
SUSE:Linux Enterprise Module for Public Cloud 15
 before 0.5.3-150000.1.9.1
0.5.3-150000.1.9.1
aws-iam-authenticator
SUSE:Linux Enterprise Module for Public Cloud 15 SP1
 before 0.5.3-150000.1.9.1
0.5.3-150000.1.9.1
aws-iam-authenticator
SUSE:Linux Enterprise Module for Public Cloud 15 SP2
 before 0.5.3-150000.1.9.1
0.5.3-150000.1.9.1
aws-iam-authenticator
SUSE:Linux Enterprise Module for Public Cloud 15 SP3
 before 0.5.3-150000.1.9.1
0.5.3-150000.1.9.1
aws-iam-authenticator
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 0.5.3-150000.1.9.1
0.5.3-150000.1.9.1
aws-iam-authenticator
openSUSE:Leap 15.3
 before 0.5.3-150000.1.9.1
0.5.3-150000.1.9.1
aws-iam-authenticator
openSUSE:Leap 15.4
 before 0.5.3-150000.1.9.1
0.5.3-150000.1.9.1
aws-iam-authenticator
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 6 CVEs
 before 0.7.18-150000.1.17.1
0.7.18-150000.1.17.1
aws-iam-authenticator
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 6 CVEs
 before 0.7.18-150000.1.17.1
0.7.18-150000.1.17.1
aws-iam-authenticator
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 6 CVEs
 before 0.7.18-150000.1.17.1
0.7.18-150000.1.17.1
aws-iam-authenticator
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 6 CVEs
 before 0.7.18-150000.1.17.1
0.7.18-150000.1.17.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2385 is a high vulnerability (CVSS 8.1) in Kubernetes Aws-iam-authenticator, published July 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in sigs.k8s.io/aws-iam-authenticator 0.5.9.

References

Show 18 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open