Cyber Resilience

CVE-2019-11248

Access Control in Kubernetes ≤ 1.12.10

Published
29 August 2019
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 8.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
EPSS Score 0.75 99.5th percentile
Risk Priority 85 floored blend · peak EPSS

Summary

CVE-2019-11248 is a high-severity Unprotected Primary Channel (CWE-419) vulnerability in Kubernetes Kubernetes. Its CVSS base score is 8.2 (High).

Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or…

more

for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated exposure of the /debug/pprof endpoint on the Kubelet healthz port enables remote attackers to exploit a public-facing application component.
T1082 System Information Discovery Discoveryconfidence: HIGH
The pprof endpoint leaks internal Kubelet memory addresses and configuration, directly facilitating system information discovery.
T1005 Data from Local System Collectionconfidence: MEDIUM
Access to the debugging endpoint can allow retrieval of sensitive data from the local Kubelet process.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-31736Shared CWE-862
CVE-2024-9109Shared CWE-862
CVE-2023-37887Shared CWE-862
CVE-2025-47688Shared CWE-862
CVE-2024-1732Shared CWE-862
CVE-2024-54269Shared CWE-862
CVE-2023-38475Shared CWE-862
CVE-2025-31786Shared CWE-862
CVE-2025-31862Shared CWE-862
CVE-2025-28103Shared CWE-862

Affected Assets

kubernetes
kubernetes
1.13.0, 1.13.1, 1.13.2, 1.13.3, 1.13.4 · ≤ 1.12.10

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 9 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-862

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

addresses: CWE-862

Reviews of access controls detect missing authorization checks on critical functions or resources.

addresses: CWE-862

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

addresses: CWE-862

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

addresses: CWE-862

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

addresses: CWE-862

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

addresses: CWE-862

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

addresses: CWE-862

Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Explicitly requires defining, enforcing, and reviewing authorizations and least privilege, directly preventing missing authorization checks.

PR.AA-03 mostly match
prevents

Strong authentication directly prevents use of an unprotected admin channel.

PR.DS-02 mostly match
prevents

Protecting data-in-transit integrity and confidentiality secures the primary channel itself.

PR.IR-01 mostly match
prevents

Network-level controls that block unauthorized logical access close the unprotected channel.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure authentication protects the primary channel from unauthorized use.

prevents

Privileged access rights directly restrict who can use the primary administrative channel.

prevents

Network security measures can help isolate or protect the primary channel.

prevents

Information access restriction limits exposure of the unprotected primary channel.

prevents

Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.

prevents

Mandatory authorization checks and central records of granted rights ensure that every access attempt is preceded by an explicit decision rather than relying on missing checks.

References