{"id":"CVE-2020-8568","aliases":["EUVD-2022-0837","GHSA-5cgx-vhfp-6cf9","GO-2022-0629"],"status":"published","title":"Kubernetes Secrets Store CSI Driver sync/rotate directory traversal","description":"Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01328,"percentile":0.71254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-22","CWE-24"],"published":"2021-01-21T17:09:21Z","modified":"2026-10-20T10:54:26Z","fixes":[{"ecosystem":"Go","package":"sigs.k8s.io/secrets-store-csi-driver","fixed_in":["0.0.17"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"sigs.k8s.io/secrets-store-csi-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.15"},{"fixed":"0.0.17"}]}]},{"source":"osv","ecosystem":"Go","package":"sigs.k8s.io/secrets-store-csi-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.15"},{"fixed":"0.0.17"}]}]},{"source":"osv","ecosystem":"Go","package":"sigs.k8s.io/secrets-store-csi-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.15"},{"fixed":"0.0.17"}]}]}],"products":[{"vendor":"kubernetes","product":"kubernetes secrets store csi driver"},{"vendor":"kubernetes","product":"secrets_store_csi_driver"}],"references":[{"url":"https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/Cb9cvymTzl4","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/378","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8568","tags":["advisory"]},{"url":"https://github.com/kubernetes-sigs/secrets-store-csi-driver/pull/371","tags":["web","fix"]},{"url":"https://github.com/kubernetes-sigs/secrets-store-csi-driver/commit/c2cbb19e2eef16638fa0523383788a4bc22231fd","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0629","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5cgx-vhfp-6cf9"},{"url":"https://github.com/kubernetes-sigs/secrets-store-csi-driver","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-8568","title":"Kubernetes Secrets Store CSI Driver sync/rotate directory traversal","description":"Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.","status":"published","published":"2021-01-21T17:09:21.45Z","modified":"2024-09-17T03:28:40.493Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-24","CWE-20"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2022-0837","description":"Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.","status":"published","published":"2021-01-21T17:09:21Z","modified":"2024-09-17T03:28:40Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:31.175316Z"}],"ghsa":[{"id":"GHSA-5cgx-vhfp-6cf9","title":"Directory traversal in Kubernetes Secrets Store CSI Driver","description":"Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a `SecretProviderClassPodStatus/Status` resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under `var/lib/kubelet/pods` that contain other Kubernetes Secrets.\n\n### Specific Go Packages Affected\nsigs.k8s.io/secrets-store-csi-driver/controllers\nsigs.k8s.io/secrets-store-csi-driver/pkg/rotation\nsigs.k8s.io/secrets-store-csi-driver/pkg/secrets-store","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-10-02T11:38:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-20","CWE-22","CWE-24"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2020-8568","description":"Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.","status":"published","published":"2021-01-21T17:15:14.157Z","modified":"2026-06-17T03:26:34.09Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-24","CWE-22"],"updated_at":"2026-11-02T14:06:30.596418Z"}],"osv":[{"id":"CVE-2020-8568","description":"Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.","status":"published","published":"2021-01-21T17:15:14.157Z","modified":"2026-10-20T10:54:26.21884676Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"GHSA-5cgx-vhfp-6cf9","title":"Directory traversal in Kubernetes Secrets Store CSI Driver","description":"Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a `SecretProviderClassPodStatus/Status` resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under `var/lib/kubelet/pods` that contain other Kubernetes Secrets.\n\n### Specific Go Packages Affected\nsigs.k8s.io/secrets-store-csi-driver/controllers\nsigs.k8s.io/secrets-store-csi-driver/pkg/rotation\nsigs.k8s.io/secrets-store-csi-driver/pkg/secrets-store","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-11-08T04:04:17.363667Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-20","CWE-22","CWE-24"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GO-2022-0629","title":"Directory traversal in sigs.k8s.io/secrets-store-csi-driver","description":"Modifying pod status allows host directory traversal.\n\nKubernetes Secrets Store CSI Driver allows an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.","status":"published","published":"2022-02-15T01:57:18Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}