Summary
generated automatically from NVD dataThe F5 BIG-IP Controller for Kubernetes (k8s-bigip-crtl), in versions 1.0.0 through 1.5.0, supplies the BIG-IP username and password to the container as command line parameters. Because of this, the credentials the container uses may be disclosed, a weakness classed as CWE-522 (insufficiently protected credentials). The flaw is rated HIGH with a CVSS v3.0 score of 8.8.
NVD description
The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which may lead to disclosure of the credentials used by the container.
EPSS · FIRST.org
1.2%probability of exploitation in the next 30 days
Higher than 68% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-29, recomputed daily by FIRST.org.
CVSS v3.0 Score
Information
- Published
- 31 juil. 2018
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- f5sirt@f5.com
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (4)
- http://www.securityfocus.com/bid/104944Third Party AdvisoryVDB Entry
- https://support.f5.com/csp/article/K58935003Vendor Advisory
- http://www.securityfocus.com/bid/104944Third Party AdvisoryVDB Entry
- https://support.f5.com/csp/article/K58935003Vendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-522
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.