CVE-2019-11248: Kubernetes Kubelet healthz port exposes unauthenticated pprof debug endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.2 with no authentication or interaction required, and a very high EPSS score, though exploitation is limited by the non-default configuration.

What it is

The Go pprof debugging endpoint /debug/pprof is served over the Kubelet's unauthenticated healthz port in Kubernetes. Because that port requires no authentication, anyone who can reach it can pull profiling data that may reveal internal Kubelet memory addresses and configuration. The issue is rated medium by the project and is not present in the default configuration.

Impact

An attacker gains read access to sensitive Kubelet internals such as memory addresses and configuration, and can cause a limited denial of service through the profiling endpoint.

Attack surface

Reachable over the network via the Kubelet healthz port; the CVSS vector shows no privileges and no user interaction required. Exposure depends on the healthz port being reachable and pprof being enabled, which the description says is not the default configuration.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented; EPSS is high at 0.7506 (99.5th percentile), and references are patch and advisory links with no exploit tags.

What to do

• Upgrade Kubernetes to 1.15.0, 1.14.4, 1.13.8, 1.12.10 or later, which contain the fix.
• Disable or restrict the pprof endpoint on the Kubelet healthz port where the version or configuration allows.
• Firewall the Kubelet healthz port so it is not reachable from untrusted networks.
• Audit Kubelet configurations for non-default settings that expose the healthz port or enable pprof.

Detection

• Monitor network access to the Kubelet healthz port for requests to /debug/pprof paths.
• Alert on external or unexpected source IPs reaching the Kubelet healthz port.
• Review Kubelet configuration and startup flags for pprof or healthz exposure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.