CVE-2019-11248
Kubernetes kubelet exposes /debug/pprof info on healthz port
- Published
- Updated
- Reserved
- Assigned by
- kubernetes
Description
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| kubernetesCNA (assigner) | 3.0 | Medium6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
| NVDNVD · Modified | 3.1 | High8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L |
- EPSS (exploitation in 30 days)
- 75.1% · top 0.5% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
- affected prior to 1.12.10
- affected prior to 1.13.8
- affected prior to 1.14.4
- affected 1.1
- affected 1.2
- affected 1.4
- affected 1.5
- affected 1.6
- affected 1.7
- affected 1.8
- affected 1.9
- affected 1.10
- affected 1.11
What to do
Workaround: update node configurations to set the "healthzBindAddress" to "127.0.0.1" to prevent access by remote callers.
References (3)
- https://github.com/kubernetes/kubernetes/issues/81023 (opens in a new tab)x_refsource_CONFIRMx_transferred
- CVE-2019-11248: /debug/pprof exposed on kubelet's healthz port (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://security.netapp.com/advisory/ntap-20190919-0003/ (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-11248)Record last updated .