Executive brief
@mittwald/kubernetes is a Node.js library for interacting with Kubernetes clusters. When debug logging is enabled via the DEBUG environment variable, the library may log sensitive data from Kubernetes Secret resources to debug logs. In cluster environments, this could expose credentials and secrets to unauthorized users who have access to pod logs but lack permissions to read secrets directly.
Technical details
The vulnerability is an information disclosure flaw (CWE-532) in the Kubernetes client library. When debug logging is enabled via the DEBUG environment variable, the client logs entire HTTP response bodies, including Secret resource contents containing sensitive data such as credentials and keys. The attack requires local access to pod logs (either via kubectl or log aggregation systems) and high privileges on the pod, but no user interaction. The issue is fixed in version 3.5.0; users can mitigate by disabling debug logging or specifically excluding the kubernetes:client debug scope.
Affected products
- Mittwald @mittwald/kubernetes <3.5.0
Timeline
- 2023-05-02: disclosed
- 2023-05-02: patched: Fixed in version 3.5.0