Skip to content
Back to search

CVE-2018-1000400

HIGH
8.8NVD

Summary

generated automatically from NVD data

Kubernetes CRI-O versions before 1.9 have a privilege context switching error in how ambient capabilities are handled. As a result, containers can run with elevated privileges and give users abilities they should not have, and the issue appears exploitable through container execution. The description says it appears to be fixed in 1.9, and the flaw is rated HIGH with a CVSS v3.0 score of 8.8.

NVD description

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9.

Share:

EPSS · FIRST.org

2.0%probability of exploitation in the next 30 days

Higher than 80% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.

CVSS v3.0 Score

8.8
/ 10.0
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Information

Published
18 mai 2018
Updated
17 juin 2026
Status
Modified
Source
cve@mitre.org

Affected products

kubernetes cri-o
Versions < 1.9.0

Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.

Weaknesses (CWE)

CWE-269

References (4)

Similar CVEs

Other vulnerabilities of type CWE-269

…

Know which CVEs hit the versions you run.

Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.

Add my first deviceI already have an account