title: Kubernetes kube-apiserver allows access to custom resources via wrong scope
description: The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
problem types: CWE-20: Improper Input Validation
affected:
{
product: Kubernetes
vendor: Kubernetes
versions:
status: affected, version: prior to 1.13.9
status: affected, version: prior to 1.14.5
status: affected, version: prior to 1.15.2
status: affected, version: 1.7
status: affected, version: 1.8
status: affected, version: 1.9
status: affected, version: 1.10
status: affected, version: 1.11
status: affected, version: 1.12
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.0
]
workarounds: To mitigate, remove authorization rules that grant access to cluster-scoped resources within namespaces. For example, RBAC roles and clusterroles intended to be referenced by namespaced rolebindings should not grant access to resources:[*], apiGroups:[*], or grant access to cluster-scoped custom resources.