title: Kubernetes  kube-controller-manager SSRF
description: The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
product: Kubernetes
vendor: Kubernetes
versions:
status: affected, version: 1.18.0
status: affected, version: 1.1
status: affected, version: 1.2
status: affected, version: 1.3
status: affected, version: 1.4
status: affected, version: 1.5
status: affected, version: 1.6
status: affected, version: 1.7
status: affected, version: 1.8
status: affected, version: 1.9
status: affected, version: 1.10
status: affected, version: 1.11
status: affected, version: 1.12
status: affected, version: 1.13
status: affected, version: 1.14
lessThan: 1.15.12, status: affected, version: 1.15, versionType: custom
lessThan: 1.16.9, status: affected, version: 1.16, versionType: custom
lessThan: 1.17.5, status: affected, version: 1.17, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
]
workarounds: Prior to upgrading, this vulnerability can be mitigated by adding endpoint protections on the master or restricting usage of the vulnerable volume types (for example by constraining usage with a PodSecurityPolicy or third-party admission controller such as Gatekeeper) and restricting StorageClass write permissions through RBAC.