CVE-2019-11245 is a high-severity (CVSS 7.8) CWE-703 vulnerability in k8s.io/kubernetes/cmd/kubelet. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for k8s.io/kubernetes/cmd/kubelet — see the affected versions and patch details below.
Kubelet Incorrect Privilege Assignment
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
k8s.io/kubernetes/cmd/kubelet🐹k8s.io/kubernetes/cmd/kubeletReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | k8s.io/kubernetes/cmd/kubelet | ≥ 1.14.0&&< 1.14.3 | 1.14.3go get k8s.io/kubernetes/cmd/kubelet@v1.14.3 |
| 🐹Go | k8s.io/kubernetes/cmd/kubelet | ≥ 1.13.0&&< 1.13.7 | 1.13.7go get k8s.io/kubernetes/cmd/kubelet@v1.13.7 |
Affected Products
kuberneteskubernetesResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for k8s.io/kubernetes/cmd/kubelet, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update k8s.io/kubernetes/cmd/kubelet to 1.14.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2019-11245 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This vulnerability only affects upstream Kubernetes versions 1.13.6 and 1.14.2. All released versions of Red Hat OpenShift Container Platform and Red Hat Gluster Storage 3 are not affected by this flaw as they do not contain the vulnerable code.
There are two potential mitigations to this issue: 1. Downgrade to kubelet v1.13.5 or v1.14.1 as instructed by your Kubernetes distribution. 2. Set RunAsUser on all pods in the cluster that should not run as root. This is a Security Context feature; the docs are at https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-podSource: Red Hat security advisory for CVE-2019-11245 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2019-11245 in your dependencies?
Find it across Go, including transitive dependencies.