CVE-2018-1000400

HIGH 8.8CVE-2018-1000400 · Published 18/05/2018 · updated 17/06/2026

In short

CVE-2018-1000400 is a HIGH (CVSS 8.8) vulnerability affecting cri-o (kubernetes).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.4% of all vulnerabilities.
Fix: update to 1.9.0 or later.

Package	Affected versions	Patched versions
cri-o kubernetes	`< 1.9.0`	`1.9.0`

Description

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9.

References

securityfocus.com/bid/104262 · Third Party Advisory
kubernetes-incubator/cri-o#1558 · Patch

More vulnerabilities in cri-o

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cri-o

kubernetes

< 1.9.0

1.9.0

Description

More vulnerabilities in cri-o

See all →