CVE-2020-8567

—

CVSS 3.1

6.5 medium

EPSS

1%p70

Published

Jan 21, 2021 (Jan 21, 2021)

Modified

Jun 17, 2026

Description

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.

Vendors: google hashicorp microsoft
Products: secret manager provider for secret store csi driver, vault provider for secrets store csi driver, azure key vault provider for secrets store csi driver
Weakness: CWE-24, CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news0 stories

No ingested article mentions this CVE yet.