VULNERABILITY INTELLIGENCE

CVE-2019-10200

CVSS score7.2 HIGH

EPSS probability1.25%

CISA KEVNot currently listed

Published2021-03-19

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. With access to the security credentials, the user then has access to the entire infrastructure. Impact to data and system availability is high.

Weakness classification

CWE-284: Improper Access Control

Primary references

secalert@redhat.com — Issue Tracking, Mitigation, Patch, Third Party Advisory
secalert@redhat.com — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mitigation, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory