{"id":"CVE-2019-11250","aliases":["DEBIAN-CVE-2019-11250","EUVD-2022-4401","GHSA-jmrx-5g74-6v2f","GO-2021-0065","RHSA-2019:4052","RHSA-2019:4087"],"status":"published","title":"Kubernetes client-go logs authorization headers at debug verbosity levels","description":"The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.","severity":{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01766,"percentile":0.78232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2019-08-29T00:40:43Z","modified":"2026-10-24T10:49:45Z","fixes":[{"ecosystem":"Go","package":"k8s.io/client-go","fixed_in":["0.17.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"k8s.io/kubernetes","fixed_in":["1.16.0-beta.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","fixed_in":["0:3.11.157-1.git.0.dfe38da.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-beta.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.17.0"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.0-beta.1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.17.0"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.157-1.git.0.dfe38da.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.27-201912021146.git.0.a40116f.el8_0"}]}],"bundled":2}],"products":[{"vendor":"kubernetes","product":"kubernetes"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/81114","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190919-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4052","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4087","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2020/10/16/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11250","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/pull/81330","tags":["web","fix"]},{"url":"https://github.com/kubernetes/kubernetes/commit/4441f1d9c3e94d9a3d93b4f184a591cab02a5245","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0065","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190919-0003","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jmrx-5g74-6v2f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11250","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1740434","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4052.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11250","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11250","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1706826","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4087.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18367","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18367","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-11250","title":"Kubernetes client-go logs authorization headers at debug verbosity levels","description":"The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.","status":"published","published":"2019-08-29T00:40:43.341Z","modified":"2024-09-17T02:06:55.457Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2022-4401","description":"The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.","status":"published","published":"2019-08-29T00:40:43Z","modified":"2024-09-17T02:06:55Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:43.354671Z"}],"ghsa":[{"id":"GHSA-jmrx-5g74-6v2f","title":"Kubernetes client-go library logs may disclose credentials to unauthorized users","description":"The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.","status":"published","published":"2022-05-24T16:55:06Z","modified":"2025-02-28T18:06:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:38:33.163519Z"}],"nvd":[{"id":"CVE-2019-11250","description":"The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.","status":"published","published":"2019-08-29T01:15:11.523Z","modified":"2026-06-17T02:12:37.283Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:05:25.691233Z"}],"osv":[{"id":"CVE-2019-11250","description":"The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.","status":"published","published":"2019-08-29T01:15:11.523Z","modified":"2026-10-24T10:49:45.507580061Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-11250","description":"The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.","status":"published","published":"2019-08-29T01:15:11.523Z","modified":"2026-09-21T07:01:26.494355667Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-jmrx-5g74-6v2f","title":"Kubernetes client-go library logs may disclose credentials to unauthorized users","description":"The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.","status":"published","published":"2022-05-24T16:55:06Z","modified":"2026-09-10T03:49:34.24839012Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"RHSA-2019:4052","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update","status":"published","published":"2024-09-16T03:22:10Z","modified":"2026-01-14T11:03:26.751345Z","cvss":[{"version":"3.0","score":4.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:4087","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1 openshift security update","status":"published","published":"2024-09-16T03:22:16Z","modified":"2026-03-23T04:47:28.697675Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"GO-2021-0065","title":"Unauthorized credential disclosure in k8s.io/kubernetes and k8s.io/client-go","description":"Authorization tokens may be inappropriately logged if the verbosity level is set to a debug level.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2026-02-04T04:03:12.393777Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}