CVE-2017-1002101

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4...

8.8 HighPublic exploitFix available

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

13.3%Up 8.8 points since Apr 14, 2021

What each source reports

CVE List Score used 8.8

Record: CVE-2017-1002101
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2017-1645 8.8

Record: EUVD-2017-1645
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rqgw-vh6p-qf7j 9.6

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4...

Record: GHSA-rqgw-vh6p-qf7j
CVSS 3.0: 9.6 CriticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-59
Updated: 2026-11-02

NVD 8.8

Record: CVE-2017-1002101
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 9.6 CriticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS 2.0: 5.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:N
Weakness: CWE-59
Updated: 2026-11-02

OSV 9.6

Record: CVE-2017-1002101
CVSS 3.0: 9.6 CriticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-1002101 9.6

Record: DEBIAN-CVE-2017-1002101
CVSS 3.0: 9.6 CriticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2018:0475 7.2

Red Hat Security Advisory: Red Hat OpenShift Container Platform security update

Record: RHSA-2018:0475
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0554-1 No score

Security update for kubernetes

This update introduces kubernetes version 1.14.1 and cri-o 1.17.1 to Leap 15.1.

Record: openSUSE-SU-2020:0554-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10901-1 No score

kubernetes-apiserver-1.22.2-21.2 on GA media

These are all security issues fixed in the kubernetes-apiserver-1.22.2-21.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10901-1
Updated: 2026-11-02

Affected products

kubernetes

Affected packages

Affected packages
Package	Affected	Fixed
`kubernetes` Debian:12	before 1.7.16+dfsg-1	1.7.16+dfsg-1
`kubernetes` Debian:13	before 1.7.16+dfsg-1	1.7.16+dfsg-1
`kubernetes` Debian:14	before 1.7.16+dfsg-1	1.7.16+dfsg-1
`atomic-openshift` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift-clients` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift-dockerregistry` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift-excluder` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift-master` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7

Show 64 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	bgeesaman/subpath-exploit	2018-03-22

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-1002101 is a high vulnerability (CVSS 8.8) in Kubernetes, published March 13, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.3%, the 96th percentile. Fixed in kubernetes 1.7.16+dfsg-1.

References

Show 52 moreShow less

Package	Affected	Fixed
`atomic-openshift-node` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift-pod` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift-tests` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`tuned-profiles-atomic-openshift-node` Red Hat:openshift:3.3::el7 From an advisory covering 2 CVEs	before 0:3.3.1.46.11-1.git.4.e236015.el7	0:3.3.1.46.11-1.git.4.e236015.el7
`atomic-openshift` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-clients` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-dockerregistry` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-excluder` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-master` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-node` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-pod` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift-tests` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`tuned-profiles-atomic-openshift-node` Red Hat:openshift:3.4::el7 From an advisory covering 2 CVEs	before 0:3.4.1.44.38-1.git.4.bb8df08.el7	0:3.4.1.44.38-1.git.4.bb8df08.el7
`atomic-openshift` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-clients` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-dockerregistry` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-excluder` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-master` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-node` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-pod` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift-tests` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`tuned-profiles-atomic-openshift-node` Red Hat:openshift:3.5::el7 From an advisory covering 2 CVEs	before 0:3.5.5.31.48-1.git.4.ff6153e.el7	0:3.5.5.31.48-1.git.4.ff6153e.el7
`atomic-openshift` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-clients` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-cluster-capacity` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-dockerregistry` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-excluder` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-federation-services` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-master` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-node` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-pod` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-service-catalog` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift-tests` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`tuned-profiles-atomic-openshift-node` Red Hat:openshift:3.6::el7 From an advisory covering 2 CVEs	before 0:3.6.173.0.96-1.git.4.e6301f8.el7	0:3.6.173.0.96-1.git.4.e6301f8.el7
`atomic-openshift` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-clients` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-cluster-capacity` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-dockerregistry` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-excluder` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-federation-services` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-master` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-node` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-pod` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-service-catalog` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-template-service-broker` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`atomic-openshift-tests` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`tuned-profiles-atomic-openshift-node` Red Hat:openshift:3.7::el7 From an advisory covering 2 CVEs	before 0:3.7.23-1.git.5.83efd71.el7	0:3.7.23-1.git.5.83efd71.el7
`cri-o` openSUSE:Leap 15.1 From an advisory covering 7 CVEs	before 1.17.1-lp151.2.2	1.17.1-lp151.2.2
`cri-tools` openSUSE:Leap 15.1 From an advisory covering 7 CVEs	before 1.18.0-lp151.2.1	1.18.0-lp151.2.1
`go1.14` openSUSE:Leap 15.1 From an advisory covering 7 CVEs	before 1.14-lp151.6.1	1.14-lp151.6.1
`kubernetes` openSUSE:Leap 15.1 From an advisory covering 7 CVEs	before 1.18.0-lp151.5.1	1.18.0-lp151.5.1