UpHeron
All vulnerabilities

Servers and applications

CVE-2019-9946

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if…

Severity
High 7.5
Published
2 Apr 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.11.9, 1.12.7, 1.13.5
Exploit chance
3.2% in the next 30 daysHigher than 88% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
KubernetesServers and applications · cpe:a:kubernetes:kubernetes
  • Version 1.14.0-rc1
  • Version 1.14.0-beta2
  • Version 1.14.0-beta1
  • Version 1.14.0-beta0
All 12 release lines
  • Every version before 1.11.9
  • From 1.12.0 before 1.12.7
  • From 1.13.0 before 1.13.5
  • Version 1.13.6-beta0
  • Version 1.14.0-alpha0
  • Version 1.14.0-alpha1
  • Version 1.14.0-alpha2
  • Version 1.14.0-alpha3
  • Version 1.14.0-beta0
  • Version 1.14.0-beta1
  • Version 1.14.0-beta2
  • Version 1.14.0-rc1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-9946
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-9946