CVE-2016-1905
HIGH7.7EPSS 0.24%Access Restriction Bypass in kubernetes
Published: 2/15/2022Modified: 2/4/2026
Description
The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object. ### Specific Go Packages Affected github.com/kubernetes/kubernetes/pkg/apiserver
Affected packages (2)
- Go/github.com/kubernetes/kubernetesfrom 0, < 1.2.0-alpha.6
- Go/github.com/kubernetes/kubernetesfrom 0, < 1.2.0-alpha.6
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N |
References (8)
- ADVISORYhttps://github.com/advisories/GHSA-xx8c-m748-xr4j
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-1905
- WEBhttps://access.redhat.com/errata/RHSA-2016:0070
- WEBhttps://access.redhat.com/errata/RHSA-2016:0351
- WEBhttps://access.redhat.com/security/cve/CVE-2016-1905
- WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=1297910
- WEBhttps://github.com/kubernetes/kubernetes/commit/9e6912384a5bc714f2a780b870944a8cee264a22
- WEBhttps://github.com/kubernetes/kubernetes/issues/19479