CVE-2021-20218

mediumpriority · track · 30EPSS 0.013 · 71 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.31% (71st) EPSS

CVSS 5.8 · medium

Is it mine?

21 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

cvss

Technical severity, 0–10. One row per scoring source.

7.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.8–7.4

v2.05.8mediumAV:N/AC:M/Au:N/C:N/I:P/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 4.9

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 5.2

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Hsecondary · OSV

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-22US

affected products (21)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
n/a fabric8-kubernetes-client≤ kubernetes-client-4.2.0 and afterenisa_euvdEU
redhat a-mq onlineall versionsnvdUScpe:2.3:a:redhat:a-mq_online:*:*:*:*:*:*:*:*
redhat build of quarkusall versionsnvdUScpe:2.3:a:redhat:build_of_quarkus:*:*:*:*:*:*:*:*
redhat codeready studio= 12.0nvdUScpe:2.3:a:redhat:codeready_studio:*:*:*:*:*:*:*:*
redhat descision manager= 7.0nvdUScpe:2.3:a:redhat:descision_manager:*:*:*:*:*:*:*:*
redhat integration camel kall versionsnvdUScpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:*
redhat jboss fuse= 7.0.0nvdUScpe:2.3:a:redhat:jboss_fuse:*:*:*:*:*:*:*:*
redhat kubernetes-client4.12.0 → 4.13.2nvdUScpe:2.3:a:redhat:kubernetes-client:*:*:*:*:*:*:*:*
redhat kubernetes-client4.2.0 → 4.7.2nvdUScpe:2.3:a:redhat:kubernetes-client:*:*:*:*:*:*:*:*
redhat kubernetes-client4.8.0 → 4.11.2nvdUScpe:2.3:a:redhat:kubernetes-client:*:*:*:*:*:*:*:*
redhat kubernetes-client5.0.0 → 5.0.2nvdUScpe:2.3:a:redhat:kubernetes-client:*:*:*:*:*:*:*:*
redhat openshift container platform= 3.11nvdUScpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
redhat process automation= 7.0nvdUScpe:2.3:a:redhat:process_automation:*:*:*:*:*:*:*:*
Maven io.fabric8:kubernetes-client4.12.0 → 4.13.2osvUSpkg:maven/io.fabric8/kubernetes-client
Maven io.fabric8:kubernetes-client4.2.0 → 4.7.2osvUSpkg:maven/io.fabric8/kubernetes-client
Maven io.fabric8:kubernetes-client4.8.0 → 4.11.2osvUSpkg:maven/io.fabric8/kubernetes-client

showing 20 of 21

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-0567Red Hat OpenShift: Mehrere SchwachstellenDeutsch2021-03-24csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.
GHSA-jwh2-ffg4-48xcImproper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client2022-05-24ghsa · osvUS
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2021-03-16modified 2026-06-17

references (17)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan