CVE-2018-1002102 — Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from strea…
Published: 2019-12-05 · CVSS: 2.6 · CVSS 3.1
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7