Summary
CVE-2019-11250 was identified during the 2019 Kubernetes Security Audit (report finding TOB-K8S-001). The kube-apiserver captures bearer tokens in system logs when the verbosity level is set to --v 10 or higher. Any user with read access to those high-verbosity logs can extract a captured token and replay it to impersonate the original authenticated user against the cluster without additional authentication.
Impact
Bearer tokens are opaque credentials that grant the full privileges of the user they were issued to. If the kube-apiserver is configured to log at verbosity level 10, bearer tokens appear in plaintext in system logs. An attacker who gains read access to those logs — for example, a user with access to the logging infrastructure but not to the production cluster — can replay any captured token and masquerade as the original bearer. The scope of the resulting access is bounded only by the privileges of the impersonated user.
Detection
Check the kube-apiserver startup arguments for a high verbosity flag:
ps aux | grep kube-apiserver | grep -- '--v'
A value of --v=10 or higher indicates that verbose logging — including bearer tokens — is active. Review who has read access to the kube-apiserver system logs (for example, via log aggregation systems, node access, or cloud provider logging services) to assess the exposure window. Audit log entries for the affected period should be treated as potentially compromised if any high-verbosity logging was active and logs were accessible to non-administrative principals.
Mitigation
The upstream advisory did not publish explicit patched version information at the time of writing. The recommended remediation is operational: reduce the kube-apiserver verbosity level to below 10 (the default is --v=2) so that authentication credentials are not captured in logs. Restrict read access to system logs to trusted administrative principals only.
For long-term hardening, implement log filtering or review policies to prevent sensitive authentication material from appearing in any log output, regardless of verbosity setting. Rotate any bearer tokens that may have been captured in high-verbosity logs and revoke the associated sessions.