CVE-2019-11243: Kubernetes

High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days.

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()

Affected products

• Kubernetes Kubernetes: from 1.12.0, up to and including 1.12.4; version 1.13.0 only
• Netapp Trident: affected versions not specified

Published 2019-04-22. Last modified 2026-06-17.