CVE-2019-11248

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

• CWE-419
• CWE-862

• https://github.com/kubernetes/kubernetes/issues/81023Patch, Third Party Advisory
• https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190919-0003/Third Party Advisory
• https://github.com/kubernetes/kubernetes/issues/81023Patch, Third Party Advisory
• https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190919-0003/Third Party Advisory

Published

Aug 29, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11242A man-in-the-middle vulnerability related to vCenter access …
• CVE-2019-11243In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.Anonymou…8.1
• CVE-2019-11244In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubec…5
• CVE-2019-11245In kubelet v1.13.6 and v1.14.2, containers for pods that do …4.9
• CVE-2019-11246The kubectl cp command allows copying files between containe…6.5
• CVE-2019-11247The Kubernetes kube-apiserver mistakenly allows access to a …8.1
• CVE-2019-11249The kubectl cp command allows copying files between containe…6.5
• CVE-2019-1125An information disclosure vulnerability exists when certain …5.6
• CVE-2019-11250The Kubernetes client-go library logs request headers at ver…6.5
• CVE-2019-11251The Kubernetes kubectl cp command in versions 1.1-1.12, and …5.7
• CVE-2019-11252The Kubernetes kube-controller-manager in versions v1.0-v1.1…6.5
• CVE-2019-11253Improper input validation in the Kubernetes API server in ve…7.5