The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| k8s.io/client-go(Go) | 0 | 0.17.0 | N/A |
| k8s.io/kubernetes(Go) | 0 | 1.16.0-beta.1 | N/A |
CVSS Metrics