{"id":"CVE-2019-11244","aliases":["EUVD-2022-0756","GHSA-2575-pghm-6qqx","RHSA-2019:3942","RHSA-2020:0020"],"status":"published","title":"kubectl creates world-writeable cached schema files","description":"In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.","severity":{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00498,"percentile":0.42924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-524","CWE-732"],"published":"2019-04-22T14:54:15Z","modified":"2026-10-24T10:49:45Z","fixes":[{"ecosystem":"Go","package":"k8s.io/client-go","fixed_in":["1.12.9"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift","fixed_in":["0:4.1.24-201911080309.git.0.c41acf2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients","fixed_in":["0:4.1.24-201911080309.git.0.c41acf2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients-redistributable","fixed_in":["0:4.1.24-201911080309.git.0.c41acf2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-hyperkube","fixed_in":["0:4.1.24-201911080309.git.0.c41acf2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift","fixed_in":["0:4.1.24-201911080309.git.0.c41acf2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients","fixed_in":["0:4.1.24-201911080309.git.0.c41acf2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients-redistributable","fixed_in":["0:4.1.24-201911080309.git.0.c41acf2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-hyperkube","fixed_in":["0:4.1.24-201911080309.git.0.c41acf2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","fixed_in":["0:3.11.161-1.git.0.4ccbe25.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.12.9"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.0"},{"fixed":"1.12.9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.24-201911080309.git.0.c41acf2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.24-201911080309.git.0.c41acf2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.24-201911080309.git.0.c41acf2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.24-201911080309.git.0.c41acf2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.24-201911080309.git.0.c41acf2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.24-201911080309.git.0.c41acf2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.24-201911080309.git.0.c41acf2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.24-201911080309.git.0.c41acf2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.161-1.git.0.4ccbe25.el7"}]}]}],"products":[{"vendor":"kubernetes","product":"kubernetes"},{"vendor":"netapp","product":"trident"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/76676","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","article"]},{"url":"http://www.securityfocus.com/bid/108064","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190509-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3942","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0020","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0074","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11244","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/pull/77874","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/77874/commits/f228ae3364729caed59087e23c42868454bc3ff4","tags":["web"]},{"url":"https://github.com/kubernetes/client-go/commit/790a4f63632139cf6731014d00a9a8338f1fbd7d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2575-pghm-6qqx"},{"url":"https://security.netapp.com/advisory/ntap-20190509-0002","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703209","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3942.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11244","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11244","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0020.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-11244","title":"kubectl creates world-writeable cached schema files","description":"In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.","status":"published","published":"2019-04-22T14:54:15Z","modified":"2024-08-04T22:48:09.162Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2022-0756","description":"In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.","status":"published","published":"2019-04-22T14:54:15Z","modified":"2024-08-04T22:48:09Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T02:40:49.362838Z"}],"ghsa":[{"id":"GHSA-2575-pghm-6qqx","title":"Kubernetes Unsafe Cacheing ","description":"In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by `--cache-dir` (defaulting to `$HOME/.kube/http-cache`), written with world-writeable permissions (`rw-rw-rw-`). If `--cache-dir` is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation. ","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-09-18T20:18:55Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-524","CWE-732"],"updated_at":"2026-11-02T14:37:05.567008Z"}],"nvd":[{"id":"CVE-2019-11244","description":"In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.","status":"published","published":"2019-04-22T15:29:00.837Z","modified":"2026-06-17T02:12:36.31Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-524","CWE-732"],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"CVE-2019-11244","description":"In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.","status":"published","published":"2019-04-22T15:29:00.837Z","modified":"2026-10-24T10:49:45.510265991Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-2575-pghm-6qqx","title":"Kubernetes Unsafe Cacheing ","description":"In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by `--cache-dir` (defaulting to `$HOME/.kube/http-cache`), written with world-writeable permissions (`rw-rw-rw-`). If `--cache-dir` is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation. ","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-11-08T04:01:00.110313Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-524","CWE-732"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"RHSA-2019:3942","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1.24 openshift security update","status":"published","published":"2024-09-16T03:16:06Z","modified":"2025-11-22T11:51:55Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0020","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update","status":"published","published":"2024-09-16T03:16:12Z","modified":"2025-11-22T11:53:49Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:06.535721Z"}]}}