Summary
CVE-2018-1002105 is a critical privilege escalation vulnerability in the Kubernetes kube-apiserver affecting all releases from v1.0.x through v1.12.2. With a specially crafted request, a user authorized to establish a connection through the kube-apiserver to a backend server can send arbitrary requests over the same connection directly to that backend, authenticated with the kube-apiserver's own TLS credentials. The default RBAC discovery policy allowed all users — including unauthenticated users — to trigger this escalation against any aggregated API server configured in the cluster.
Impact
Two distinct attack paths exist. First, any API call to an aggregated API server endpoint can be escalated to perform any request against that backend server using the kube-apiserver's TLS credentials, as long as the aggregated API server is reachable from the kube-apiserver's network. The default RBAC policy exposes this to all users, authenticated and unauthenticated alike. Second, pod exec, attach, and portforward permissions can be escalated to perform arbitrary requests against the kubelet API on the node specified in the pod spec, enabling attackers to list all pods on the node, execute commands inside any pod, and retrieve command output. Pod exec/attach/portforward permissions are granted to the default admin and edit RBAC roles.
Detection
Determine whether your cluster has aggregated API servers configured, which is the primary prerequisite for the first attack path:
kubectl get apiservices \
-o 'jsonpath={range .items[?(@.spec.service.name!="")]}{.metadata.name}{"\n"}{end}'
If no names are returned, or if the kube-apiserver is an older version that does not expose the apiservices API, the cluster has no aggregated API servers configured and is only exposed via the pod exec/attach/portforward path. Review API server audit logs for unexpected cross-backend requests or anomalous kubelet API calls following exec or attach operations.
Mitigation
Upgrade to the patched release for your release branch: v1.10.11, v1.11.5, v1.12.3, or v1.13.0-rc.1.
If an immediate upgrade is not possible, restrict RBAC permissions to limit who can perform discovery API calls and pod exec/attach/portforward operations to only principals that require full kubelet or backend API access. Specifically, review whether the default RBAC roles grant exec/attach/portforward to users who should not have full node-level access, and tighten accordingly.
Note: clusters running v1.0.x through v1.9.x have no patch available within those release branches and must upgrade to a patched minor release. Distributors may provide backport patches for older releases; contact your distribution vendor for guidance.