Loading vulnerability…
CVE-2018-1002105 is a privilege escalation vulnerability in Kubernetes kube-apiserver affecting all versions prior to v1.10.11, v1.11.5, and v1.12.3. The flaw is caused by incorrect handling of error responses to proxied upgrade requests in the API server. By sending a specially crafted request, an attacker who is authorized to connect through the Kubernetes API server can cause the API server to establish a connection to a backend service and then continue sending arbitrary requests over that same connection. Those backend requests are authenticated with the kube-apiserver's own TLS client credentials used for the proxied connection, rather than the attacker's original privileges. This breaks the intended trust boundary between the API server and backend components such as aggregated API servers or kubelets and can allow the attacker to act as the API server toward those backends.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository provides two Python proof-of-concept exploits for CVE-2018-1002105, a critical privilege escalation vulnerability in the Kubernetes API server. The repository contains two main exploit scripts: 'poc.py' (authenticated exploit) and 'unauth_poc.py' (unauthenticated exploit), along with supporting HTTP request templates ('stage_1', 'stage_2', 'ustage_1', 'ustage_2'). - 'poc.py' targets the Kubernetes API server using a valid JWT token with sufficient privileges. It exploits the WebSocket upgrade mechanism to gain code execution on privileged pods (such as etcd) by sending crafted HTTP requests. The default payload extracts the etcd database file, which may contain sensitive cluster secrets. - 'unauth_poc.py' targets the aggregated API layer of Kubernetes, exploiting the same vulnerability to escalate privileges to cluster-admin by forging HTTP headers. This can allow an attacker to access or control resources exposed by the aggregated API. Both exploits require network access to the Kubernetes API server and interact directly with its HTTP endpoints. The repository is well-structured, with clear separation between authenticated and unauthenticated attack paths, and includes usage instructions and demos in the README. No hardcoded IPs or domains are present; the target is specified at runtime. The code is functional and demonstrates the core exploit technique for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A historical Kubernetes API server privilege escalation vulnerability mentioned for background context only.
A Kubernetes privilege escalation vulnerability affecting OpenShift, mentioned only as historical background.
A historical OpenShift privilege escalation vulnerability that allowed users to gain cluster-admin privileges via API server flaws, mentioned as prior vendor security history.
A Kubernetes API server proxy request handling privilege escalation vulnerability mentioned as part of security detections tied to the observed activity.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.