{"id":"CVE-2020-8567","details":"Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.","aliases":["GHSA-2v35-wj4r-rcmv","GO-2024-2750"],"modified":"2026-08-27T08:15:20.014352Z","published":"2021-01-21T17:15:14.063Z","related":["CGA-269c-qf3v-96p6"],"references":[{"type":"ADVISORY","url":"https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY"},{"type":"FIX","url":"https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/azure/secrets-store-csi-driver-provider-azure","events":[{"introduced":"0"},{"fixed":"6c8a7ca593437de34c3feb49ec5e05726356b7e0"}],"database_specific":{"cpe":"cpe:2.3:a:microsoft:azure_key_vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.0.10"}],"source":"CPE_RANGE"}}],"versions":["0.0.9","0.0.8","0.0.7","0.0.6","0.0.5","0.0.4","0.0.3","0.0.2","0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8567.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/googlecloudplatform/secrets-store-csi-driver-provider-gcp","events":[{"introduced":"0"},{"fixed":"6296c84d191846e793301fd1dda64629afcb4279"}],"database_specific":{"cpe":"cpe:2.3:a:google:secret_manager_provider_for_secret_store_csi_driver:*:*:*:*:*:kubernetes:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.2.0"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8567.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/hashicorp/vault-csi-provider","events":[{"introduced":"0"},{"fixed":"92e7538f295f5c3075aec35d9674120bc43fcf1d"}],"database_specific":{"cpe":"cpe:2.3:a:hashicorp:vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.0.6"}],"source":"CPE_RANGE"}}],"versions":["0.0.5","0.0.4","0.0.3","0.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8567.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes-sigs/secrets-store-csi-driver","events":[{"introduced":"0"},{"fixed":"3061e7d3e5c99b98e09acc67458b67a804ba9aa8"},{"fixed":"3d5ee72289095cedd839855e3a590a52f83e84e5"},{"fixed":"7d29b46f6831a6da0213444e0b97544ecee7f772"}],"database_specific":{"source":"CPE_RANGE","cpe":["cpe:2.3:a:google:secret_manager_provider_for_secret_store_csi_driver:*:*:*:*:*:kubernetes:*:*","cpe:2.3:a:hashicorp:vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:*","cpe:2.3:a:microsoft:azure_key_vault_provider_for_secrets_store_csi_driver:*:*:*:*:*:kubernetes:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"0.2.0"},{"fixed":"0.0.6"},{"fixed":"0.0.10"}]}}],"versions":["v0.0.23","v0.0.22","v0.0.21","v0.0.20","v0.0.19","v0.0.18","v0.0.17","v0.0.16","v0.0.15","v0.0.14","v0.0.13","v0.0.12","v0.0.11","v0.0.10","v0.0.9","v0.0.8","v0.0.7","v0.0.6","v0.0.5","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8567.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}