{"id":"CVE-2020-8567","aliases":["EUVD-2022-2051","GHSA-2v35-wj4r-rcmv","GO-2024-2750"],"status":"published","title":"Kubernetes Secrets Store CSI Driver plugin directory traversals","description":"Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01492,"percentile":0.74311,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-24"],"published":"2021-01-21T17:09:21Z","modified":"2026-10-24T10:50:41Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/vault-csi-provider","fixed_in":["0.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/Azure/secrets-store-csi-driver-provider-azure","fixed_in":["0.0.10"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp","fixed_in":["0.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault-csi-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/Azure/secrets-store-csi-driver-provider-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.10"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault-csi-provider","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/Azure/secrets-store-csi-driver-provider-azure","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.10"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/Azure/secrets-store-csi-driver-provider-azure","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault-csi-provider","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"google","product":"secret_manager_provider_for_secret_store_csi_driver"},{"vendor":"hashicorp","product":"vault_provider_for_secrets_store_csi_driver"},{"vendor":"kubernetes","product":"kubernetes secrets store csi driver"},{"vendor":"microsoft","product":"azure_key_vault_provider_for_secrets_store_csi_driver"}],"references":[{"url":"https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8567","tags":["advisory"]},{"url":"https://github.com/Azure/secrets-store-csi-driver-provider-azure/pull/298","tags":["web","fix"]},{"url":"https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp/pull/74","tags":["web","fix"]},{"url":"https://github.com/hashicorp/secrets-store-csi-driver-provider-vault/pull/50","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2v35-wj4r-rcmv","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-8567","title":"Kubernetes Secrets Store CSI Driver plugin directory traversals","description":"Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.","status":"published","published":"2021-01-21T17:09:21.322Z","modified":"2024-09-16T18:23:40.732Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2022-2051","description":"Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.","status":"published","published":"2021-01-21T17:09:21Z","modified":"2024-09-16T18:23:40Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:32.945265Z"}],"ghsa":[{"id":"GHSA-2v35-wj4r-rcmv","title":"Kubernetes Secrets Store CSI Driver plugins arbitrary file write","description":"Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including `/var/lib/kubelet/pods`.","status":"published","published":"2022-05-24T17:40:02Z","modified":"2024-11-18T16:26:26Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L","level":"low"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:19.029049Z"}],"nvd":[{"id":"CVE-2020-8567","description":"Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.","status":"published","published":"2021-01-21T17:15:14.063Z","modified":"2026-06-17T03:26:33.97Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-24","CWE-22"],"updated_at":"2026-11-02T14:06:30.596418Z"}],"osv":[{"id":"CVE-2020-8567","description":"Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.","status":"published","published":"2021-01-21T17:15:14.063Z","modified":"2026-10-24T10:50:41.314961965Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"GHSA-2v35-wj4r-rcmv","title":"Kubernetes Secrets Store CSI Driver plugins arbitrary file write","description":"Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including `/var/lib/kubelet/pods`.","status":"published","published":"2022-05-24T17:40:02Z","modified":"2026-09-10T03:49:37.173343782Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"GO-2024-2750","title":"Kubernetes Secrets Store CSI Driver plugins arbitrary file write in github.com/Azure/secrets-store-csi-driver-provider-azure","description":"Kubernetes Secrets Store CSI Driver plugins arbitrary file write in github.com/Azure/secrets-store-csi-driver-provider-azure.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/Azure/secrets-store-csi-driver-provider-azure before v0.0.10; github.com/hashicorp/vault-csi-provider before v0.0.6.","status":"published","published":"2024-06-05T15:10:52Z","modified":"2026-06-19T18:29:26.78161765Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}