Kube-State-Metrics vulnerabilitiesRanked by how likely they are to be used.
Kube-State-Metrics is made by Kubernetes. We track 1 published vulnerability in it, across 19 versions. None of them is on the list of flaws known to be exploited today. If you run Kube-State-Metrics, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Kube-State-Metrics vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Kube-State-Metrics's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Running Kube-State-Metrics? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.
- Matched to
- Kube-State-Metrics on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 1 published vulnerability listed under the name Kube-State-Metrics, across 19 versions.
None of Kube-State-Metrics's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Kube-State-Metrics. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.