CVE-2018-1002105: Kubernetes kube-apiserver proxy upgrade flaw enables backend access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or interaction required, near-top EPSS percentile, and public exploit code make this an urgent patch target.

What it is

The kube-apiserver mishandles error responses to proxied upgrade requests, letting a crafted request establish a connection through the API server to a backend server and then send arbitrary requests over that connection. Because those requests are authenticated with the API server's own TLS credentials, the attacker effectively inherits the API server's backend identity. This is a critical privilege escalation path in affected Kubernetes clusters.

Impact

An attacker gains the ability to issue arbitrary requests to backend servers using the API server's TLS credentials, bypassing normal authorization boundaries and potentially reaching cluster-internal services and data.

Attack surface

Reached over the network through the kube-apiserver's proxied upgrade handling; the CVSS vector indicates no privileges or user interaction are required, though the description does not state whether any API access is needed to trigger the proxy path.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.86978, 99.7th percentile) and public exploit references exist (Exploit-DB 46052/46053 and a GitHub PoC), indicating mature public exploitation.

What to do

• Upgrade kube-apiserver to v1.10.11, v1.11.5, v1.12.3 or later, or apply the vendor errata for OpenShift and NetApp Trident.
• Restrict network access to the Kubernetes API server to trusted management networks only.
• Audit and reduce RBAC permissions that allow users to create pods or otherwise reach the API server proxy path.
• Monitor vendor advisories (Red Hat RHSA, NetApp, openSUSE) for updated builds and apply them promptly.

Detection

• Review kube-apiserver audit logs for proxied upgrade requests that return errors followed by unexpected backend connections.
• Alert on API server connections to backend services originating from the API server's own TLS identity outside normal controller behavior.
• Hunt for known exploit tooling or PoC artifacts (Exploit-DB 46052/46053, GitHub poc_CVE-2018-1002105) in cluster workloads and images.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.