Minikube RCE via DNS Rebinding

published 2018-12-05 7 y ago modified 2026-06-17 4 mo ago also GHSA-6pcv-qqx4-mxm3 , GO-2023-1961 , EUVD-2022-2835

cvss: 8.1; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits: 0; none known

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.

Patch / fix

fixed in 1

Kubernetes Minikube v0.30.0

Exploit prediction

0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	k8s.io/minikube	>=0.3.0, <=0.29.0 >=0.3.0	no fix listed

Affected products

Kubernetes Minikube

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

github.com /kubernetes/minikube/issues/3208
web, issue-tracking, mitigation, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2018-1002103
advisory
github.com /advisories/GHSA-6pcv-qqx4-mxm3
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary