title: Kubernetes secrets-store-csi-driver discloses service account tokens in logs
description: Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.
problem types: CWE-532 Insertion of Sensitive Information into Log File
affected:
{
vendor: Kubernetes
product: secrets-store-csi-driver
repo: https://github.com/kubernetes-sigs/secrets-store-csi-driver
versions:
status: affected, version: 0, lessThan: 1.3.3, versionType: semver
status: unaffected, version: 1.3.3
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
]
workarounds: Prior to upgrading, this vulnerability can be mitigated by running secrets-store-csi-driver at log level 0 or 1 via the -v flag.