Taking Action to Secure Our IBM Cloud Kubernetes Service Against Recent Kubernetes Security Vulnerabilities

Share this post:

What’s happening?

We’re taking action to secure our IBM Cloud Kubernetes Service against the recent Kubernetes security vulnerabilities.

IBM Cloud Kubernetes Service is affected by the following vulnerabilities that, in some cases, allow unauthorized access to Kubernetes and/or trusted user privilege escalation.

Vulnerability Details

Affected Products and Versions

  • Affected components: Kubernetes API server
  • Affected versions: Kubernetes versions 1.0.x through 1.12.x
    • 1.12.0-1.12.2 (fixed in v1.12.3)
    • 1.11.0-1.11.4 (fixed in v1.11.5)
    • 1.10.0-1.10.10 (fixed in v1.10.11)
    • 1.9.x and 1.8.x (update to v1.10.11)
    • 1.7 (update to 1.9.x and then update to 1.10.11)
    • 1.5 (unsupported, no migration path)

What do I need to know?

This exposure affects your IBM Cloud Kubernetes cluster master only, there is no exposure to your IBM Cloud Kubernetes Workers.

There are two exploits as part of this vulnerability:

Vulnerability 1: Authenticated and unauthenticated requests can provide full admin access to Kubernetes API Server.

  • Affected users: This only affects users with aggregated API servers.
    • 1.11 and earlier: IBM Cloud Kubernetes Service does not deploy any aggregated API servers in versions 1.11 and earlier. You will not be impacted unless you have deployed your own aggregated API server.
    • 1.12: All users are affected since all clusters contain the metrics-server, which is an aggregated API server affected by this vulnerability.

Vulnerability 2: Authenticated users with specific permissions to exec/attach/portforward API calls can be escalated to perform any API request against the kubelet API on the node specified in the pod spec.

  • Affected users: All IBM Cloud Kubernetes Service clusters are affected by this vulnerability.

We have released updates for all supported releases of IBM Cloud Kubernetes Service. All supported clusters will auto-update to remediate the vulnerabilities.

How do I mitigate the issue?

If you are on a supported release, then you don’t need to do anything, your IBM Cloud Kubernetes Cluster Master will be updated automatically.

All supported IBM Cloud Kubernetes Service clusters at version 1.10 and later will be updated automatically to address this security flaw. If you find that your cluster has not been automatically updated over the next few days, please contact IBM Support.

Customers running unsupported IBM Cloud Kubernetes versions must upgrade the affected clusters to a supported version 1.10.11, 1.11.5, 1.12.3, or later when these versions are released by IBM.

Refer to for more information about Kubernetes versions.

You do not need to update your workers for this exposure, we do recommend that you always stay current with your workers to ensure you are not vulnerable to other exposures.

How do I check my version?

To see which Kubernetes versions the IBM Cloud Kubernetes Service has released:
ibmcloud ks kube-versions

To see which version your clusters are currently using:
ibmcloud ks clusters

What about unsupported clusters?

For 1.9.x or 1.8.x, you must update your cluster to a supported release:
ibmcloud ks cluster-update --cluster <clustername> --kube-version 1.10

For 1.7.x, you must first update to 1.9 and then update to a supported release:

  1. Run: ibmcloud ks cluster-update --cluster <clustername> --kube-version 1.9
  2. Confirm that the update completed successfully by checking the Kubernetes version.
  3. Run: >ibmcloud ks cluster-update --cluster <clustername> --kube-version 1.10

Questions or comments

Please join us on our public Slack channel at or raise a support ticket if you have any issues.


Distinguished Engineer, Site Reliability Engineering, IBM Cloud

More Support stories
May 3, 2019

Kubernetes Tutorials: 5 Ways to Get You Building Fast

Ready to start working with Kubernetes? Want to build your Kubernetes skills? The five tutorials in this post will teach you everything you need to know about how to manage your containerized apps with Kubernetes.

Continue reading

May 3, 2019

Using Portworx to Deploy and Manage an HA MySQL Cluster on IBM Cloud Kubernetes Service

This tutorial is a walkthrough of the steps involved in deploying and managing a highly available MySQL cluster on IBM Cloud Kubernetes Service.

Continue reading

May 2, 2019

Kubernetes v1.14.1 Now Available in IBM Cloud Kubernetes Service

We are excited to announce the availability of Kubernetes v1.14.1 for your clusters that are running in IBM Cloud Kubernetes Service. IBM Cloud Kubernetes Service continues to be the first public managed Kubernetes service to support the latest upstream versions from the community.

Continue reading