UpHeron
All vulnerabilities

Servers and applications

CVE-2018-1002105

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's…

Severity
Critical 9.8
Published
5 Dec 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
87% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
KubernetesServers and applications · cpe:a:kubernetes:kubernetes
  • From 1.0.0 up to 1.9.11
  • Version 1.9.12-beta0
  • From 1.10.0 up to 1.10.10
  • From 1.11.0 up to 1.11.4
  • From 1.12.0 up to 1.12.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-1002105
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-1002105