Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

CVE-2019-1002101 — kubernetes

MEDIUMFix: kubernetes/kubernetes#75037

CVE-2019-1002101 is a medium-severity (CVSS 5.5) CWE-59 vulnerability in k8s.io/kubernetes. 2 public exploit references exist, so weaponization risk is real. A fix is available for k8s.io/kubernetes — see the affected versions and patch details below.

Symlink Attack in kubectl cp

Also known asGHSA-34jx-wx69-9x8vGO-2022-0782
Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
2 known
Exploitation data as of Sep 29, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
12.7%probability of exploitation in next 30 days
Moderate Risk0.00%
Lower risk than most CVEs96th percentile — riskier than 96% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2019-1002101 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,987 CVEs with a current EPSS score, this one falls in the 10–50% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

3 pkgs affected
🐹k8s.io/kubernetes🐹k8s.io/kubernetes🐹k8s.io/kubernetes

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
🐹Gok8s.io/kubernetesall versions1.11.9go get k8s.io/kubernetes@v1.11.9
🐹Gok8s.io/kubernetes≥ 1.12.0&&< 1.12.71.12.7go get k8s.io/kubernetes@v1.12.7
🐹Gok8s.io/kubernetes≥ 1.13.0&&< 1.13.51.13.5go get k8s.io/kubernetes@v1.13.5

Affected Products

2 products · 7 configurations
Application
kuberneteskubernetes
≥ 1.13.0 && < 1.13.5
1 version
1.14.0
Application
openshift container platformredhat
3 versions
3.93.103.11
Exploits & PoCs
2

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

The kubectl cp command allows copying files between containers and the u…

github.comGithubApr 2019

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for k8s.io/kubernetes, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update k8s.io/kubernetes to 1.11.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2019-1002101 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This issue affects Kubernetes starting from version 1.9. OpenShift Container Platform (OCP) versions 3.9 and later are also affected. This issue did not affect the version of Kubernetes(embedded in heketi) shipped with Red Hat Gluster Storage 3 as it does not contain the vulnerable code.

ProductFixed inAdvisory
Red Hat OpenShift Container Platform 3.10atomic-enterprise-service-catalog-1:3.10.127-1.git.55.b54f8c7.el7RHBA-2019:0620
Red Hat OpenShift Container Platform 3.11atomic-enterprise-service-catalog-1:3.11.98-1.git.0.a7877b0.el7RHBA-2019:0636
Red Hat OpenShift Container Platform 3.9ansible-service-broker-0:1.1.20-1.el7RHBA-2019:0619

Frequently Asked Questions

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in k
O3 Security · Impact-Aware SCA

Is CVE-2019-1002101 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2019-1002101: kubernetes — Fixed in 1.11.9