title: Kubernetes kubelet exposes /debug/pprof info on healthz port
description: The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
problem types: CWE-419: Unprotected Primary Channel
affected:
{
product: Kubernetes
vendor: Kubernetes
versions:
status: affected, version: prior to 1.12.10
status: affected, version: prior to 1.13.8
status: affected, version: prior to 1.14.4
status: affected, version: 1.1
status: affected, version: 1.2
status: affected, version: 1.4
status: affected, version: 1.5
status: affected, version: 1.6
status: affected, version: 1.7
status: affected, version: 1.8
status: affected, version: 1.9
status: affected, version: 1.10
status: affected, version: 1.11
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.0
]
workarounds: update node configurations to set the "healthzBindAddress" to "127.0.0.1" to prevent access by remote callers.