-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing scope validation in the request handling path. The patch adds critical checks comparing CRD scope (cluster/namespaced) with request scope, returning 404 for mismatches. The vulnerable version's ServeHTTP implementation did not perform these checks, allowing improper authorization evaluation. The code changes in the commit directly address this by introducing scope validation logic in the request handling flow.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| k8s.io/apiextensions-apiserver | go | >= 0.7.0, < 0.13.9 | 0.13.9 |
| k8s.io/apiextensions-apiserver | go | >= 0.14.0, < 0.14.5 | 0.14.5 |
| k8s.io/apiextensions-apiserver | go | >= 0.15.0, < 0.15.2 | 0.15.2 |