Kubernetes Official CVE Feed

/debug/pprof exposed on kubelet's healthz port

Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal

API server allows access to custom resources via wrong scope

container uid changes to root after first restart or if image is already pulled to the node

rest.AnonymousClientConfig() does not remove the serviceaccount credentials from config created by rest.InClusterConfig()

`kubectl:-http-cache=<world-accessible dir>` creates world-writeable cached schema files

json-patch requests can exhaust apiserver resources

proxy request handling in kube-apiserver can leave vulnerable TCP connections

smb mount security issue

Kubectl copy doesn't check for paths outside of it's destination directory.

atomic writer volume handling allows arbitrary file deletion in host filesystem

subpath volume mount handling allows arbitrary file access in host filesystem

Azure PV should be Private scope not Container scope

PodSecurityPolicy admission plugin authorizes incorrectly