UpHeron
All vulnerabilities

Servers and applications

CVE-2019-11250

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

Severity
Medium 6.5
Published
29 Aug 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.15.3
Exploit chance
1.8% in the next 30 daysHigher than 78% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
KubernetesServers and applications · cpe:a:kubernetes:kubernetes
  • Version 1.16.0-beta2
  • Version 1.16.0-beta1
  • Version 1.16.0-alpha3
  • Version 1.16.0-alpha2
All 8 release lines
  • Every version before 1.15.3
  • Version 1.15.3
  • Version 1.15.4-beta0
  • Version 1.16.0-alpha1
  • Version 1.16.0-alpha2
  • Version 1.16.0-alpha3
  • Version 1.16.0-beta1
  • Version 1.16.0-beta2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-11250
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-11250