title: [minikube] Network Port exposure in minikube running on macOS using Docker driver
description: This vulnerability exposes a network port in minikube running on macOS with Docker driver that could enable unexpected remote access to the minikube container.
problem types: CWE-266 Incorrect Privilege Assignment
affected:
{
vendor: Kubernetes
product: minikube
versions:
version: 1.26.0, status: affected, lessThan: unspecified, versionType: custom
version: unspecified, lessThanOrEqual: 1.28.0, status: affected, versionType: custom
platforms: macOS
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
]
solutions: To mitigate these vulnerabilities, upgrade minikube to the latest version and delete any clusters created using an affected version. To delete clusters created using prior versions, run `minikube delete --all`
workarounds: To continue using an existing cluster, change the default port mappings of the minikube container and restart the docker daemon -
docker run -v /var/lib/docker:/var/lib/docker -e MINIKUBE_CONTAINER_ID="$(docker ps --no-trunc -aqf 'name=^minikube$')" -it --entrypoint /bin/sh alpine
sed -i 's/0.0.0.0/127.0.0.1/g' /var/lib/docker/containers/$MINIKUBE_CONTAINER_ID/config.v2.json