Secret leaks in logs for vSphere Provider kube-controller-manager

Also known as GHSA-5xfg-wv98-264m, GO-2024-2755

Published 5 y ago 2020-12-07 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.7

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.5%

percentile 46%

Public exploits

none known

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Exploit prediction (EPSS)

0.54% probability of exploitation in the next 30 days, higher than 46% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	4.7	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N`
CNA	3.1	4.7	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	3.1	5.5	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:P/I:N/A:N`
GitHub	3.1	6.3	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/kubernetes/kubernetes`	<1.19.3	1.19.3
go	`k8s.io/kubernetes`	<1.19.3	1.19.3

Affected products

Kubernetes Kubernetes

Classification

Weakness

CWE-532 Insertion of Sensitive Information into Log File

Technology feeds

Kubernetes (RSS, critical only)

References

github.com /kubernetes/kubernetes/issues/95621 · x_refsource_CONFIRM, x_transferred
groups.google.com /g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ · mailing-list, x_refsource_MLIST, x_transferred
security.netapp.com /advisory/ntap-20210122-0006/ · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2020-8563 · advisory
github.com /kubernetes/kubernetes/pull/95236 · web
github.com /kubernetes/kubernetes/pull/95236/commits/247f6dd09299bc7893c1e0affea11c0255025b96 · web
bugzilla.redhat.com /show_bug.cgi?id=1886635 · web
github.com /kubernetes/kubernetes · package
groups.google.com /g/kubernetes-announce/c/ScdmyORnPDk · web
security.netapp.com /advisory/ntap-20210122-0006 · web
github.com /advisories/GHSA-5xfg-wv98-264m · advisory

Sources

CVE List: CVE-2020-8563
GitHub Advisory: GHSA-5xfg-wv98-264m
NVD: CVE-2020-8563
OSV: GO-2024-2755

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary