CVE-2019-9946 Misconfiguration in n/a
The CNI portmap plugin misconfigures iptables rules, allowing HostPort traffic to bypass specific Kubernetes service definitions and security policies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-9946?
CVE-2019-9946 is a high-severity vulnerability in Kubernetes Kubernetes, published on 2 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.
Weakness: CWE-670
Which versions are affected by CVE-2019-9946?
It affects 3 products.
Linux distribution packages (2)
containernetworking-plugins Red Hat:rhel_extras_other:7 | All versions | 0:0.7.5-2.el7 |
containernetworking-plugins-debuginfo Red Hat:rhel_extras_other:7 | All versions | 0:0.7.5-2.el7 |
Products include Cncf Portmap, Kubernetes Kubernetes, Netapp Cloud Insights.
How do I fix CVE-2019-9946?
Upgrade to a fixed version.
Is CVE-2019-9946 being exploited?
There is no known exploitation of CVE-2019-9946 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2025-IG62048, DEBIAN-CVE-2019-9946, GHSA-6g96-g4m6-hw69, RHBA-2019:0862.