Beware! Critical Remote Access Vulnerability Found in Minikube on macOS

CVSScvssV3_1: 9.8

Minikube is a tool that helps developers run Kubernetes locally. However, a critical remote access vulnerability has now been discovered in Minikube when used on macOS systems with Docker as the container runtime.

The vulnerability tracked as CVE-2023-1174 has been given a CVSS score of 9.8 out of 10, indicating its extremely critical severity. It involves a network port in the minikube container being exposed unexpectedly. This could allow an attacker from the internet to gain remote access to the minikube container running on the user’s system.

By default, minikube runs a single node Kubernetes cluster locally for testing and development. However, due to this vulnerability, any application or service deployed to this local cluster could now be accessed remotely without authorization.

An attacker could exploit this vulnerability by scanning for open ports to identify vulnerable minikube instances and then connecting to gain shell access. This would give them control over not just the local Kubernetes cluster but potentially the host system as well.

The best way to protect yourself is to update Minikube to the latest version immediately. Version 1.26.0 fixes this vulnerability. Users are also advised to only run Minikube behind a firewall and not expose ports to the public internet until updated. Regular security updates of software components are recommended to prevent such vulnerabilities.