{"id":"CVE-2021-4178","aliases":["EUVD-2022-6304","GHSA-98g7-rxmf-rrxm","RHSA-2023:3299"],"status":"published","title":"fabric8 kubernetes-client vulnerable","description":"A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00335,"percentile":0.27121,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502","CWE-94"],"published":"2022-07-15T05:17:35Z","modified":"2026-10-24T10:50:26Z","exploits":[{"source":"pocgithub","id":"shoucheng3/fabric8io__kubernetes-client_CVE-2021-4178_5-0-2","title":"shoucheng3/fabric8io__kubernetes-client_CVE-2021-4178_5-0-2","date":"2025-08-17","url":"https://github.com/shoucheng3/fabric8io__kubernetes-client_CVE-2021-4178_5-0-2"}],"fixes":[{"ecosystem":"Maven","package":"io.fabric8:kubernetes-client","fixed_in":["5.0.3","5.1.2","5.3.2","5.7.4","5.8.1","5.10.2","5.11.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-beta-1"},{"fixed":"5.0.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.3.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.7.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.0"},{"fixed":"5.8.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0"},{"fixed":"5.10.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.11.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-beta-1"},{"fixed":"5.0.3"}]}],"versions":["5.0.0","5.0.0-beta-1","5.0.1","5.0.2"]},{"source":"osv","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.2"}]}],"versions":["5.1.0","5.1.1"]},{"source":"osv","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.3.2"}]}],"versions":["5.2.0","5.2.1","5.3.0","5.3.1"]},{"source":"osv","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.7.4"}]}],"versions":["5.5.0","5.6.0","5.7.0","5.7.1","5.7.2","5.7.3"]},{"source":"osv","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.0"},{"fixed":"5.8.1"}]}],"versions":["5.8.0"]},{"source":"osv","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0"},{"fixed":"5.10.2"}]}],"versions":["5.10.0","5.10.1","5.9.0"]},{"source":"osv","ecosystem":"Maven","package":"io.fabric8:kubernetes-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.11.2"}]}],"versions":["5.11.0","5.11.1"]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1684911916-1.el8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.387.3.1684911776-3.el8"}]}],"bundled":16}],"products":[{"vendor":"redhat","product":"a-mq_streams"},{"vendor":"redhat","product":"build_of_quarkus"},{"vendor":"redhat","product":"descision_manager"},{"vendor":"redhat","product":"fabric8-kubernetes"},{"vendor":"redhat","product":"fuse"},{"vendor":"redhat","product":"integration_camel_k"},{"vendor":"redhat","product":"integration_camel_quarkus"},{"vendor":"redhat","product":"openshift_application_runtimes"},{"vendor":"redhat","product":"process_automation"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034388","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4178","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/advisories/GHSA-98g7-rxmf-rrxm","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/fabric8io/kubernetes-client/issues/3653","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4178","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/cve-2021-4178","tags":["web"]},{"url":"https://www.mend.io/vulnerability-database/CVE-2021-4178","tags":["web"]},{"url":"https://github.com/fabric8io/kubernetes-client/commit/445103004d1ed3153d5abb272473451d05891e39","tags":["web"]},{"url":"https://github.com/fabric8io/kubernetes-client","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3299","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134292","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185707","tags":["report"]},{"url":"https://issues.redhat.com/browse/PITEAM-10","tags":["article"]},{"url":"https://issues.redhat.com/browse/PITEAM-9","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3299.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7692","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4178","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46877","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22978","tags":["advisory"]},{"url":"https://tanzu.vmware.com/security/cve-2022-22978","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080850","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25647","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40151","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40152","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3f7h-mf4q-vrm4","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42889","tags":["advisory"]},{"url":"https://blogs.apache.org/security/entry/cve-2022-42889","tags":["article"]},{"url":"https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om","tags":["article"]},{"url":"https://seclists.org/oss-sec/2022/q4/22","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24422","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24998","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","tags":["advisory"]},{"url":"https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25761","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25761","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25762","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3019","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27900","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27901","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27902","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27902","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-1807","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27904","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-2120","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2021-4178","description":"A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.","status":"published","published":"2022-08-24T15:02:11Z","modified":"2024-08-03T17:16:04.264Z","cwes":["CWE-502"],"updated_at":"2026-11-02T14:33:07.697752Z"}],"euvd":[{"id":"EUVD-2022-6304","description":"A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.","status":"published","published":"2022-08-24T15:02:11Z","modified":"2024-08-03T17:16:04Z","updated_at":"2026-11-03T03:25:10.418596Z"}],"ghsa":[{"id":"GHSA-98g7-rxmf-rrxm","title":"fabric8 kubernetes-client vulnerable ","description":"fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing.","status":"published","published":"2022-07-15T05:17:35Z","modified":"2023-05-22T15:25:13Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-94","CWE-502"],"updated_at":"2026-11-02T14:36:53.103029Z"}],"nvd":[{"id":"CVE-2021-4178","description":"A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.","status":"published","published":"2022-08-24T16:15:09.77Z","modified":"2026-06-17T04:19:09.863Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-4178","description":"A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.","status":"published","published":"2022-08-24T16:15:09.77Z","modified":"2026-10-24T10:50:26.356186046Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"GHSA-98g7-rxmf-rrxm","title":"fabric8 kubernetes-client vulnerable ","description":"fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing.","status":"published","published":"2022-07-15T05:17:35Z","modified":"2026-07-08T06:28:37.537894124Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-502","CWE-94"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"RHSA-2023:3299","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T16:34:57Z","modified":"2026-10-13T10:04:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"}]}}