CVE-2020-8567— Kubernetes Secrets Store CSI Driver plugin directory traversals
Quick assessment
Affected
Kubernetes Kubernetes Secrets Store CSI Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kubernetes SIGs Secrets-store-csi-driver是Kubernetes SIGs组织的一个基于CSI卷用于存储机密文件的K8s组件。 Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6 存在安全漏洞，攻击者可利用该漏洞创建特殊制作的SecretProviderClass对象来写入主机文件系统上的任意文件路径。
Possible ATT&CK Techniques 3 AI
T1041 · Exfiltration Over C2 Channel T1059 · Command and Scripting Interpreter T1608 · Stage Capabilities
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-8567
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kubernetes Secrets Store CSI Driver plugin directory traversals
Source: CVE Program / CVE List V5
Vulnerability Description
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
路径遍历：’../filedir’
Source: CVE Program / CVE List V5
Vulnerability Title
Kubernetes SIGs Secrets-store-csi-driver 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kubernetes SIGs Secrets-store-csi-driver是Kubernetes SIGs组织的一个基于CSI卷用于存储机密文件的K8s组件。 Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6 存在安全漏洞，攻击者可利用该漏洞创建特殊制作的SecretProviderClass对象来写入主机文件系统上的任意文件路径。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Kubernetes | Kubernetes Secrets Store CSI Driver | Vault Plugin ~ v0.0.6 | - |
|
II. Public POCs for CVE-2020-8567
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-8567
请登录查看更多情报信息。
Other References for CVE-2020-8567 (2)
Same Patch Batch · Kubernetes · 2021-01-21 · 5 CVEs total
| CVE-2020-8554 | 6.3 MEDIUM | Kubernetes man in the middle using LoadBalancer or ExternalIPs |
| CVE-2020-8568 | 5.8 MEDIUM | Kubernetes Secrets Store CSI Driver sync/rotate directory traversal |
| CVE-2020-8569 | 4.3 MEDIUM | Kubernetes CSI snapshot-controller DoS |
| CVE-2020-8570 | Kubernetes Java client libraries unvalidated path traversal in Copy implementation |
IV. Related Vulnerabilities
Same vendor: Kubernetes
-
CVE-2026-15687
Path traversal via non-tar copyDirectoryFromPod -
CVE-2026-3864
CSI Driver for NFS path traversal via subDir may delete unin -
CVE-2026-4342
ingress-nginx comment-based nginx configuration injection -
CVE-2026-3288
ingress-nginx rewrite-target nginx configuration injection -
CVE-2025-15566
ingress-nginx auth-proxy-set-headers nginx configuration inj
Same weakness: CWE-24
-
CVE-2026-14947
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnera -
CVE-2026-76353
Path Traversal through Knowledge Bundle Replication in Splun -
CVE-2026-73573
Zimbra Collaboration <10.1.17 路径穿越漏洞 -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-66140
Exim 路径遍历漏洞
V. Comments for CVE-2020-8567
No comments yet